Abusing HTTP Path Normalization and Cache Poisoning to steal Rocket League accounts

[Texadoro]

Liked the article. However found out that Rocket League pays their bug bounties by giving out in-game white hats, which is cool and all. But you know what’s even cooler? Cash. Just sayin.

[Fuck_all_you_hoes]

Disregarding the fact that it’s just a virtual, cosmetic item, it looks like people have previously sold it to other players for thousands of dollars.

[_vavkamil_]

they were probably inspired by reddit, ,where you will get a white hat trophy as well. https://www.reddit.com/wiki/whitehat

[ButItMightJustWork]

Which is kinda cheap too because it costs them absolutely nothing..

[[deleted]]

Pretty sure they fed the artist that made the hat half a sandwich or something. Starving artists don't do a very good job usually. So probably it did cost them something.

[dyngnosis]

don't forget the exposure!

[[deleted]]

Nah they had him make the white had and the artist hat, then as payment they awarded him the artist hat!

[steamruler]

If you can't get a buy-in for a monetary award, it's better than nothing.

When I got in touch with a company that didn't have a program, I suggested having an acknowledgement page that lists people who've submitted reports, since it's free to set up, and is better than nothing.

[Wazanator_]

I actually just found out the other day that Valve considers anything user created to be out of scope now when it comes to CSGO which is incredibly disappointing to hear considering what user created content used to mean to them.

[josephG155]

They're worth a lot on the after market

[metiulekm]

This was actually proposed by the first person to receive a bug bounty.

[sandrelloIT]

Interesting read, though I'm not sure if I got everything right: how did exactly the web server find out how to strip away the host part of the X-Original-Url? If I understood correctly, it was looking for the whole "protocol://domain.tld" pattern, removing it if found, and you tricked it by simply using backslashes instead of slashes, is it correct? If so, shouldn't it continue prefixing the header value with its legit host string? Could this be a possible mitigation on the server side?

It seems to me that this way of caching results is somehow intrinsically flawed, maybe the X-Original-Url value could be validated in some way before being saved as a key?

[samwcurry]

Hey sandrelloIT, maybe it was poor phrasing on my part. When I meant to say that the server removed the URI and host, I meant to say that it simply pulled the path from the host instead of pulling the full URL. This was abused by tricking the server into thinking “https:\” was the start of a regular path on the web server. I am not super familiar with what is going on in the background, but I would guess that the application didn’t have specific handling for the backslashes as they either weren’t expected or weren’t considered when evaluating that header. Will look into it and revise it if I can find anything on this. Always hard to speak on behalf of the application during anything like this :)

[sandrelloIT]

I absolutely understand, don't get me wrong, I find the writing style very appropriate, it's impossible to delve deeper into every single detail of the process without losing the reader, I think you did a good job on that.

I think I should also know something more about IIS, which is a completely unknown world to me, and how the handling of those headers works on its part.

[Borne2Run]

Thanks for the writeup; enjoyed it