Steam Windows Vulnerability Lets Users Escalate Privileges to NT AUTHORITY\SYSTEM
BrokenPipe proof of concept achieves NT AUTHORITY\SYSTEM privilege escalation via Steam Client Service's install-script handling on fully patched Windows 10/11.
A published PowerShell proof of concept called BrokenPipe abuses the Steam Client Service (steamservice.exe), which runs as SYSTEM, by leveraging IClientInstallUtils::AddInstallScriptToWhiteList and RunInstallScript: a legitimate Valve-signed VDF install script is not bound to a fixed installation root, so a local user supplies an attacker-controlled directory and gets a whitelisted launcher executed as Local System (SID S-1-5-18). The PoC was tested on Steam Client 10.96.30.42 on fully updated 64-bit Windows 10 and 11 and requires no admin credentials, UAC bypass, signature forgery, Steam login, or modification of Valve-signed files. No CVE or Valve patch is mentioned; defenders should monitor for unusual child processes from steamservice.exe and unexpected IPC activity.
- Steam Client Service executes an attacker-placed launcher with SYSTEM privileges via signed VDF abuse
- Exploit needs no admin credentials, UAC bypass, signature forgery, Steam login, or file tampering
- Defenders should watch for odd child processes from steamservice.exe and suspicious PowerShell use
From the original article
2 min read at gbhackers.com
A newly published proof of concept called “BrokenPipe” has revealed a local privilege escalation vulnerability in the Steam Client Service on Windows systems. According to the project’s GitHub repository, this flaw could allow a standard, non-administrative Windows user to make the Steam Client Service launch an executable with NT AUTHORITY\SYSTEM privileges. The proof of concept […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.