[Fixed][EXPLOIT] Cross-Site Scripting on Steam
There's an exploit with Steam in which users are able to do Cross-Site Scripting from their profiles. This means they can do a slew of malicious things to a user who falls victim to viewing the persons profile.
For now DO NOT look at anyone's Steam Profile who you do not know.
Proof: My profile: https://steamcommunity.com/profiles/76561197964898382
Source on this?
By|UDG| The Commanderat 7th of February 2017 06:18:43
Source on this?
My profile: https://steamcommunity.com/profiles/76561197964898382
I'm sure Valve will push out a update that should fix this. Also is this something that you did to your own profile to show or can anyone do this?
I'm guessing it's still the one with guides, this bug was a thing weeks ago at the same time as the golden name became a widely spread exploit. Why have they still not fixed it, incompetent...
Edited Or did they literally fix it on the guides page only, and ignore the fact it still works when you put the guide as a showcase, ueghhh
Edited
ByII_PYRO_IIat 7th of February 2017 08:05:00
I'm sure Valve will push out a update that should fix this. Also is this something that you did to your own profile to show or can anyone do this?
Absolutely anyone can as long as you're level 10+
ByMarcuzat 7th of February 2017 08:05:15
I'm guessing it's still the one with guides, this bug was a thing weeks ago at the same time as the golden name became a widely spread exploit. Why have they still not fixed it, incompetent...EditedOr did they literally fix it on the guides page only, and ignore the fact it still works when you put the guide as a showcase, ueghhhEditedAbsolutely anyone can as long as you're level 10+
You'd expect a multi-billion dollar company to understand the simplicity of escaping.
Byxbeastguyxat 7th of February 2017 08:22:31
You'd expect a multi-billion dollar company to understand the simplicity of escaping.
Why can't I find anything about this exploit on their sub-reddit? It has literally been purged from existence. They never check their security email either it seems. Valve has really been fucking up recently, a classic example of not giving a fuck.
ByMarcuzat 7th of February 2017 08:29:43
Why can't I find anything about this exploit on their sub-reddit? It has literally been purged from existence. They never check their security email either it seems. Valve has really been fucking up recently, a classic example of not giving a fuck.
It's quite sad. If something like this doesn't get patched soon enough, people can begin to do much worse than what is currently going on.
The previous guides exploit was just a CSS exploit I was told, this is literally fullblown XSS, lovely. Depending on how they validate sessions, this could get bad
shameless show off thread xd
ByPaperlacksat 7th of February 2017 08:38:41
shameless show off thread xd
What? Clearly this is alerting people to a real, and serious exploit. This isn't a show-off thread at all.
lol
Isnt this banable?
Has been fixed.
Took them long enough, probably been there since the guides showcase came out.
I'm going to go ahead and close this since it's been patched.
Closed