Zero-day privilege escalation vulnerability in gaming platform Steam could impact over 100 Million users || Shubham Yadav Ethical Hacker ||

Zero-day privilege escalation vulnerability in gaming platform Steam could impact over 100 Million users

• Security researcher learned that the registry key for Steam service has explicit “Full control” for “Users” group, and these permissions are applicable for all subkeys and their subkeys.
• Successful exploitation of this vulnerability could allow an attacker to run any program with highest privileges on any Windows system with Steam installed.

A security researcher named Felix detected a zero-day privilege escalation vulnerability in the Steam game client for Windows. This vulnerability could allow an attacker to run a program with administrator privileges.

More details on the vulnerability

Successful exploitation of this vulnerability could allow an attacker to run any program with highest privileges on any Windows system with Steam installed.

• Felix learned that the registry key (HKLM\SOFTWARE\Wow6432Node\Valve\Steam) for Steam service has explicit “Full control” for “Users” group, and these permissions are applicable for all subkeys and their subkeys.
• To confirm this, the security researcher created a test key (HKLM\Software\Wow6432Node\Valve\Steam\Apps\test) and restarted the service.
• This gave the researcher full (read and write) access to the key.

“So, now we have a primitive to take control on almost every key in the registry, and it is easy to convert it into a complete EoP (Escalation of Privileges). I choose key HKLM\SYSTEM\ControlSet001\Services\msiserver that corresponds with the service “Windows Installer”, which can be started by any user, same as Steam’s service, but run program as NT AUTHORITY\SYSTEM,” the researcher said in a report.

Vulnerability disclosure

The security researcher reported the vulnerability to the parent company Valve Corporation via HackerOne on June 15, 2019. Valve marked the vulnerability as “Not Applicable” citing “Attacks that require the ability to drop files in arbitrary locations on the user's filesystem” and “Attacks that require physical access to the user’s device.”

However, after 45 days of the initial disclosure, the security researcher has made the vulnerability public as there are 125 million active accounts on Steam and this could impact all the potential users.

Another security researcher named Matt Nelson created a proof-of-concept (PoC) code for the vulnerability and shared it on GitHub.

More: instagram.com/shubhamyadavethicalhacker 

Support Us By Clicking On This Link: Click on Me

Thank You...........

POSTED BY SHUBHAM YADAV

My name is Shubham Yadav and I am Certified Ethical Hacker and a student in India, passion is in Internet and Ethical Hacking and Cyber Security, I believe in helping people with my abilities and knowledge base.