A group of security researchers known as the Secret Club took to Twitter to report a remote code execution bug in the Source 3D game engine developed by Valve and used for building games with tens of millions of unique players.
A vulnerability in the game engine propagates to products built with it. In this case, multiple game titles built with Source are affected and require a patch to eliminate the risk to users.
One of the researchers in the group says that they disclosed the vulnerability to Valve about two years ago, yet it continues to affect the latest release of Counter Strike: Global Offensive (CS:GO).
Some of the games that utilize Valve’s Source engine include Counter-Strike, Half-Life, Half-Life 2, Garry’s Mod, Team Fortress, Left 4 Dead, and Portal.
What irks the group is that after all this time they cannot publish the technical details about the bug because the bug is still affecting some games.
Bounty paid, bug still active
Florian, a student passionate about reverse engineering, reported the remote code execution (RCE) flaw two years ago through Valve’s bug bounty program on HackerOne.
He told BleepingComputer that the vulnerability is a memory corruption in the Source engine code, so it’s present in multiple game titles. Exceptions are games built with Source 2 or those that run a modified version of the Source engine, like Titanfall.
However, among the games affected is CS:GO, whose latest update was on March 31. Last month, the game counted close to 27 million unique players, according to stats on the game’s page.
In a conversation with BleepingComputer, Florian said that CS:GO still had the vulnerable Source code on April 10th and the bug could be exploited to run arbitrary code on a machine running the game.
He made a demo video showing how an attacker could exploit the vulnerability and execute code on a target computer by simply sending a Steam game invitation to the victim.
The last Florian heard from Valve was about six months ago, when Valve paid him a bounty and said that it was in the process of fixing the problem, and that it had addressed it in one specific game using the Source engine.
The researcher did not disclose which game received the fix but told us that he was able to confirm Valve’s actions.
“We intentionally did not mention that because we do not want people to search for the patch in the game binaries as this would greatly reduce the effort to rebuild the exploit for all the other unpatched games” – Florian
Florian is a member of the Secret Club, a non-profit group of reverse engineers who complained on Twitter over Valve taking so long to address the issue in all games.
Some bug bounty programs on HackerOne have a policy that allows researchers to disclose exploits or vulnerabilities if a fix is not available after a reasonable period like 90 or 180 days. Valve is not among them.
While Valve does not actively prevent Florian from sharing the details, the researcher has strong ethical principles and knows that full disclosure would put millions of users at risk.
Researchers claim Valve ignores reports
Carl Schou, a leading member of the Secret Club, told BleepingComputer that an attacker could leverage this RCE vulnerability to steal sensitive information like credentials or banking information.
Secret Club has published multiple videos showcasing exploits of RCE bugs in CS:GO from multiple researchers claiming that Valve ignored them for long periods, from five months to a year.
The one below – from Brymko, Carl Smith, and Simon Scannell – shows an exploit of a Source engine RCE flaw when joining a malicious community server.
Here’s another one where RCE is also achieved after connecting to a malicious server. Software engineer Bien Pham says that they reported it to Valve last year on April 2 and the company ignored them.
It is unclear if all the videos show demonstration of the same remote code execution bug.
BleepingComputer reached out to Valve earlier today for comment about Florian’s vulnerability disclosure through HackerOne but has not heard from the company by publishing time. We will update the article when a statement from Valve becomes available.
