A proof-of-concept exploit named BrokenPipe abuses the Steam Client Service to elevate a standard Windows user to NT AUTHORITY\SYSTEM without displaying a UAC prompt or requiring administrator credentials.
The issue was disclosed on GitHub by security researcher KillaBoi (@killa), who says Valve had been notified about the vulnerability since March. According to the researcher, the corresponding HackerOne report was later marked as a duplicate by HackerOne staff, prompting the decision to publicly release the proof of concept in hopes of accelerating a fix.
BrokenPipe targets steamservice.exe, the Windows service installed with Valve's Steam client. The service normally runs with SYSTEM privileges and performs operations that require elevated permissions on behalf of the Steam client.
Steam is Valve's digital distribution platform for PC games and one of the most widely deployed gaming applications on Windows. This makes a local privilege escalation weakness in its privileged service particularly relevant even though an attacker must already have local code execution on the targeted computer.
According to the technical write-up, the vulnerability stems from how the Steam Client Service handles signed installation-script VDF files. While the VDF itself carries a legitimate Valve signature, a caller-controlled installation root used by the service is allegedly not covered by that signature.
BrokenPipe connects to the Steam Client Service without administrator rights and calls IClientInstallUtils::AddInstallScriptToWhiteList, supplying a genuine Valve-signed VDF together with an attacker-controlled installation location. This causes a relocated launcher to become trusted.
The exploit then invokes IClientInstallUtils::RunInstallScript, causing the SYSTEM-level Steam service to process the VDF and execute the selected launcher with its own privileges. The PoC ultimately starts C:\Windows\System32\cmd.exe as SYSTEM, with whoami /user returning the Local System SID S-1-5-18.
The researcher stresses that BrokenPipe does not forge, modify, or bypass Valve's VDF signature. Instead, it exploits what is described as a gap in what the signature actually covers.
Testing was performed against Steam version 10.96.30.42 on recent 64-bit Windows 10 and Windows 11 systems. Steam does not need to be authenticated, and no game has to be running for the demonstration to work.
While BrokenPipe requires an attacker to already have code execution as a local user, that limitation does not make the issue harmless. Commodity malware, infostealers, remote-access trojans, and post-exploitation tools frequently look for local privilege-escalation vulnerabilities after gaining an initial foothold. A flaw in software as common as Steam could therefore give malware a convenient route from limited user privileges to full SYSTEM-level control.
We contacted Valve about the reported vulnerability but have not received a response. Until the issue is addressed, users and administrators should treat unexpected processes launched through Steam's privileged service as potentially suspicious and use security products that monitor privilege-escalation activity and unusual SYSTEM-level child processes.
Leave a Reply