Valve waited 15 months to patch high-severity flaw. A hacker pounced

guest · Feb 9, 2023

Vulnerability had a 8.8 severity rating. Valve took its time patching anyway.
February 10, 2023

Researchers have unearthed four game modes that could successfully exploit a critical vulnerability that remained unpatched in the popular Dota 2 video game for 15 months after a fix had become available.
Click to expand...

The vulnerability, tracked as CVE-2021-38003, resided in the open source JavaScript engine from Google known as V8, which is incorporated into Dota 2. Although Google patched the vulnerability in October 2021, Dota 2 developer Valve didn’t update its software to use the patched V8 engine until last month after researchers privately alerted the company that the critical vulnerability was being targeted.
Click to expand...

Unclear intentions
A hacker took advantage of the delay by publishing a custom game mode last March that exploited the vulnerability, researchers from security firm Avast said. That same month, the same hacker published three additional game modes that very likely also exploited the vulnerability. Besides patching the vulnerability last month, Valve also removed all four modes.
Click to expand...

The first game mode published by Valve appears to be a proof-of-concept project for exploiting the vulnerability. It was titled “test addon plz ignore” (ID 1556548695) and included a description that urged people not to download or install it.

Avast researchers went on to find three more custom modes that the same developer had published to Valve. These modes—titled “Overdog no annoying heroes” (id 2776998052), “Custom Hero Brawl” (id 2780728794), and Overthrow RTZ Edition X10 XP (id 2780559339)—took a much more covert approach.
Click to expand...

In an email, Vojtěšek described the operation flow of the backdoor this way:

The victim enters a game, playing one of the malicious game modes.

The game loads as expected, but in the background, a malicious JavaScript contacts the game mode’s server.

The game mode’s server code reaches out to the backdoor’s C&C server, downloads a piece of JavaScript code (presumably, the exploit for CVE-2021-38003), and returns the downloaded code back to the victim.

The victim dynamically executes the downloaded JavaScript. If this was the exploit for CVE-2021-38003, this would result in shellcode execution on the victim machine.

Click to expand...

Avast: Dota 2 Under Attack: How a V8 Bug Was Exploited in the Game

By Jan Vojtěšek - February 8, 2023
When we think about V8 exploits, the first things that come to mind are probably related to sophisticated browser zero-day exploit chains. While the browser may be the most interesting target for V8 exploits, we shouldn’t forget that this open-source JavaScript engine is also embedded into countless projects other than the browser. And where a JavaScript engine is used across a security boundary to execute potentially untrusted code, security issues may arise.
Click to expand...

Log in or Sign up

Valve waited 15 months to patch high-severity flaw. A hacker pounced

guest Guest

Log in or Sign up

Valve waited 15 months to patch high-severity flaw. A hacker pounced

guest Guest

Useful Searches