We have observed a wave of Remote Code Execution vulnerabilities affecting Steam games and Workshop maps. 9 games so far: Unturned Twice, Stick Fight Once, Mecha Chameleon once, Banana Shooter, Perfect Heist 2, Golf Gang, Bean Battles, Grapples Galore & Fragsurf The attack is as follows: - Victim joins a server - Workshop map downloads automatically - The map contains a .exe/.vbs/.bat/.dll file - The map loads, and somehow, a completely intentional game feature executes a file. A "visit website" button handler wired to Application.OpenURL or even an animation event. A map scripting entity. Blueprint on BeginPlay. Funny enough tho, the game doesn't actually run a file. It rather just asks windows to open it (basically the same thing). This falls into the category of RCE, and is just as dangerous regardless if we like it or not. In at least 4 titles, the entire exploit chain is Application.OpenURL("payload.bat"). This is a function intended for opening the developer's website. And it is being used to open malware. Most of these are already exploited in the wild by the same actor, who we assume is very bored? (V7rtual) One game we came across (Redmatch 2) was NOT vulnerable. They validate content at load time and strip animator events. This is apparently possible. Valve could end a good chunk of this entire wave overnight with a file-extension filter on workshop content and Mark-of-the-Web on downloads. Instead, each developer is discovering that Application.OpenURL executes files individually and by the time many people get their PCs infected. Not so fun fact: Streamer @KickPapaGambles was hit by this nonsense and got 70,000$ stolen and drained off his wallets, all because he got social engineered to play Grapples Galore. Controversial takes, - Don't let workshop maps contain a .bat file - A function named OpenURL should open a URL @vxunderground @EricParker @Steam