Valve has patched an HTML injection vulnerability in the popular Counter-Strike 2 (CS2) game that could be abused to expose the IP addresses of other players in the same lobby.
While many exploited the HTML injection flaw to embed images in the game’s kick voting panel, some used it to execute IP logger scripts.
Unlike most games, Counter-Strike 2 is designed to accept HTML code directly in its text input fields, and it didn’t validate these inputs.
There have been widespread discussions about the CS2 vulnerability on gaming forums this week. Initially, gamers feared the vulnerability allowed cross-site scripting (XSS) attacks. While some saw the exploit as harmless, others highlighted the potential that exposed IP addresses could lead to DDoS attacks and unauthorized access to personal data.
User “Crouch9706” was among the first to post about the flaw on a forum on Monday, explaining: “the XSS worked and [we] got the IPs of our teammates.”
‘A Lot Scarier Than Just an IP Leak’
According to security experts, gamers whose IP addresses are leaked through this vulnerability could be targeted with DDoS (Distributed Denial-of-Service) attacks, forcing them offline.
“Of course, it’s not the biggest risk, with many players being behind ISPs that use CGNAT, making the harvested IPs rather useless. However, this sort of unexpected code injection is really not acceptable from a security standpoint,” hacking website Hackaday commented on Tuesday.
In an email to VPNOverview, security researcher mr.d0x said the vulnerability could’ve led to more serious security risks.
“The vulnerability allows users of a platform to inject HTML and potentially social engineer other users (e.g. injecting a <form> tag with fields asking for username and password),” he wrote. “However, in the case of CS2, the vulnerable field had a size limit and therefore prevents a lot of these issues.”
mr.d0x emphasized the importance of platforms validating users’ input to prevent such a privacy breach. “This is pretty much application security 101, but it’s much easier said than done,” he noted.
How to Play Counter-Strike 2 Safely
We urge gamers to take measures to stay safe online. For starters, keep your games updated with the latest patches, which often include critical security fixes. Also, avoid suspicious links and requests in games and game-related communications like emails or messages.
Monitor your accounts closely for any signs of unauthorized access, use secure passwords, and enable two-factor authentication on gaming and associated email accounts for an extra layer of security. We also recommend you use a virtual private network (VPN) to mask your IP address. Check out our guide to the best gaming VPNs for some suggestions.
Remember to report any potential security threats or vulnerabilities to the game developer’s support team.
For more news, follow us on X (Twitter), Threads, and Mastodon!
