A single Twitch chat message can execute code on a streamer's PC through OBS Studio
How one Twitch chat message became code execution on a streamer’s PC
A malicious Twitch chat message can achieve native code execution on a streamer's Windows PC by chaining an unsanitized chat overlay with an outdated Chromium vulnerability. The attack requires OBS Studio 32.2.2 or older running default security settings. Orange researchers found the overlay injected viewer messages as raw HTML, creating an XSS flaw, then exploited CVE-2024-7971 in the bundled Chromium 127 — a flaw Google fixed in Chrome 128 and which has been exploited in the wild. OBS has since disabled the Chromium sandbox, removing the need for a separate sandbox escape.
The researcher stressed that a default OBS installation is not automatically vulnerable to Twitch messages.
- Scryptonite
Deja Vu. I had to submit an issue and fix a similar issue years ago -- it was similarly Twitch chat overlay XSS, but for that they (the streamer) at least tried to strip the tags (but it was a poor JS implementation of PHP strip_tags), and the streamer didn't understand the issue until I crafted a image with onload/onerror to freeze/hang the chat overlay.
- doodlesdev
Fucking absurd. I'll forever hate developers who allow for such _bizarre_ exploit chains to happen. OBS is an OSS project which I believe has received a lot of love throught the years, but having the Chromium sandbox disabled due to authentication with _certain services_ not working with it enabled is asinine. Don't even want to imagine the other problems the project might have waiting to be exploited.
Sure, if the plugin developer sanitized the comments before inserting them, this wouldn't have happened _this way_, but having a browser engine two years outdated (for a reason which IMO is absolutely reasonable compared to other situations before) and having the Chromium sandbox completely disabled with nothing to substitute it is crazy in a software onto which people insert random plugins from the internet to get random functionality.
Hopefully those two changes ship fast to OBS. I may be supporting the project financially in the future if they update their security posture, as I'm generally very fond of OBS.
- WesSouza
“a Twitch chat overlay that rendered viewer messages as raw HTML”
Well damn.
- soulofmischief
This would be an interesting writeup if it wasn't so unfocused due to being written or heavily edited by an LLM.
- charcircuit
https://github.com/obsproject/obs-browser/pull/523
Not even counting the time it took to make this PR, releasing a security update for the browser took 4 months to merge. For reference Brave has a 1 day SLA for releasing the update itself after a security fix gets published.