Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets

guest · Aug 16, 2021

Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets
Valve plugs an API bug found in its Steam platform that that abused the Smart2Pay system
August 16, 2021
https://threatpost.com/valve-bug-unlimited-funds/168710/

A security researcher helped Valve, the makers of the gaming platform Steam, plug an easy-to-exploit hole that allowed users to add unlimited funds to their digital wallet. Simply by changing the account’s email address, the exploit allowed anyone to artificially boost their digital billfold to anything they wanted.

Working for the HackerOne bug-bounty program, security researcher DrBrix, reported the bug last Monday. By Wednesday, Valve plugged the hole and paid DrBrix $7,500 for identifying the bug.
Click to expand...

The bug, which has since been patched, was exploited by abusing Valve’s own application programming interface (API) used to communicate with the third-party web payment firm Smart2Pay, owned by Nuvei.

According to DrBrix, the hack allowed an attacker to intercept the POST request sent from Valve to Smart2Pay. This was done via modifying the Steam user’s email address used by Smart2Pay as it passed through the Valve API.
Click to expand...

Valve first rated the bug as of moderate importance. However, after investigating, it escalated the bug to critical in nature, scoring it “9-10”, with the highest possible rating 10.
Click to expand...

plat · Aug 16, 2021

Nice and very good that the researcher was paid but 7500 USD seems a little paltry for a vulnerability like that. If you look it up, Valve's est. worth is 4 billion. It's also of interest that it was founded by two Microsoft employees but it seems Valve is more inclined to acknowledge, patch and pay than Microsoft, a trillion dollar corp. was in several documented instances.

Log in or Sign up

Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets

guest Guest

plat Registered Member

Log in or Sign up

Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets

guest Guest

plat Registered Member

Useful Searches