# Vulnerability in GoldSource Engine allows to upload and run an arbitrary DLL on client

GoldSource HTTP fast-download path skips IsSafeFileToDownload, letting a malicious server push an arbitrary DLL into the client mod folder that loads on next start.

- Payout: hidden
- Severity: high
- Program: Valve
- Found by: kohtep2010
- Disclosed: 2020-03-25
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/508894
- Library page: https://bugbountylibrary.com/r/h1%3A508894
- Tags: area:os domain:desktop impact:mass-exploit impact:rce kind:bounty platform:hackerone sev:high tech:windows technique:reverse-engineering technique:source-review vuln:file-upload vuln:misconfiguration vuln:path-traversal vuln:rce

**Target:** hl.exe client / GoldSource resource download system (CL_BatchResourceRequest, CL_CheckFile, Netchan_CopyFileFragments)
**Root cause:** CL_CheckFile only blocks '..' and 'server.cfg' substrings; the stronger IsSafeFileToDownload is applied only to generic resources and only on the netchan path, not the HTTP sv_downloadurl path.
**Steps:**
1. Set `sv_downloadurl` to an attacker HTTP host (e.g. `http://127.0.0.1` for local test).
2. In SV_CreateResourceList call `SV_AddResource (t_eventscript, filename, FS_FileSize (filename), RES_FATALIFMISSING, 0);` with filename `bin\TrackerUI.dll`.
3. Host `bin\TrackerUI.dll` on the sv_downloadurl server.
4. Connect client to the server; client downloads the DLL into the mod folder via HTTP without IsSafeFileToDownload check.
5. On next game start client.dll Initialize loads TrackerUI.dll.
**How found:** Reverse-engineered engine binaries (IDA pseudocode of build 7960), compared the two download paths (netchan vs HTTP) and noticed IsSafeFileToDownload runs in Netchan_CopyFileFragments but not on the HTTP path, and only for generic resources.
**Exploitation:** Malicious server operator registers a forbidden-extension resource (eventscript type) and serves it over HTTP via sv_downloadurl; client fetches it into the mod folder bypassing the safety filter, and the DLL is loaded by client.dll on next launch, enabling mass malware distribution to connecting players.
**Escalation:** Any mod lacking a vanilla TrackerUI.dll can be targeted, so a single malicious server can infect all connecting players at scale.
**Insight:** When a binary has two code paths for the same operation (UDP netchan vs HTTP fast-download), diff which validation each path invokes; a check present in one path is often absent in the other, and per-resource-type validation may only cover one type.