# [Hubs] - Broken access control in placing objects in hubs room

Mozilla Hubs chat /add command bypasses room object-creation restrictions, letting unauthenticated non-members spawn persistent objects and videos.

- Payout: hidden
- Severity: medium
- Program: Mozilla
- Found by: quikke
- Disclosed: 2023-07-20
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1987011
- Library page: https://bugbountylibrary.com/r/h1%3A1987011
- Tags: area:web3 domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:websocket technique:source-review vuln:access-control vuln:business-logic vuln:ssrf

**Target:** hubs.mozilla.com chat command dispatch / websocket object creation
**Root cause:** Object creation permission checks are enforced only client-side in message-dispatch.js; the server does not validate room access-control rules when processing websocket create-object requests.
**Steps:**
1. Admin creates room and disables 'Create and move objects' and 'Pin objects' in room settings.
2. Attacker joins room (or spectator) and opens chat.
3. Send `/add https://.../DuckyMesh-...glb` to spawn an object despite restrictions.
4. Send `/add --no-menu <url>` to spawn an unremovable object or YouTube video.
5. Optionally set `const entered=true` in message-dispatch.js via devtools to bypass the client-side room-entry check and run commands as spectator.
**How found:** Reading message-dispatch.js revealed the room-entry check was client-side only; testing chat /add commands in a restricted room showed objects still spawned, indicating server-side authorization was missing.
**Exploitation:** Attacker sends chat /add commands that reach the websocket backend, which creates objects in the room without checking the disabled permissions; --no-menu makes objects unremovable and videos unstoppable, allowing griefing of events.
**Escalation:** Client-side `entered` flag can be forced true in devtools to execute commands without joining the room; /add with attacker-controlled URL triggers backend pingbacks (potential SSRF, unexplored).
**Insight:** Chat slash-commands that map to privileged websocket actions are a common place where client-side gating hides missing server-side authorization; test each command in a room with permissions disabled.