Bypass "Consequences" capability roblox sandbox

Bug Reports Engine Bugs
,
1

I don’t know if this is intentional so im reporting it anyways

If the sandboxed script has access to Players capability but doesn’t have Consequences capability you can still workaround it by just destroying the Player instance or just calling ClearAllChildren on Players service

same thing works if you just do Player:ResetPropertyToDefault(“Parent”) and the player will be removed from the game regardless of not having Consequences capability

however the behavior changes if you disable Players capability everything is blocked but you cannot access PlayerGui and stuff like that so disabling Players capability will break innocent scripts that aren’t trying to bypass the sandbox and legitmately use the player instance

once again i do not know if this is intentional but i thought reporting it would be worth it since it does count as a capability bypass

Old rbxl repro

consequences protection failure.rbxl (61.0 KB)

Latest rbxl repro

consequences protection failure latest.rbxl (60.9 KB)

Expected behavior

all attempts to destroy, clearallchildren, resetproperytodefault(“parent”) calls on Player instances and Players service should be disabled if the calling script doesn’t have the Consequences capability

3 Likes
2

update: i would like to mention stuff like Player.Parent=nil and deprecated Player:Remove() works too and completely bypasses that Consequences capability

edit: i think i’ll just update the repro rbxl to include these too

edit 2: alright repro updated so its easier to read now

3

I agree with this person he is completely in the right here I think he should be devforum mod

1 Like
4

i know various games that destroy the player object to kick cheaters because cheaters hook the :Kick function

changing this would break stuff unless sandboxing is off, probably would be in most cases

5

what??? no it won’t break anything since usually the anti exploits have roblox capability sandbox disabled and it doesn’t affect them at all

additionally patching this will help games like bird sandbox to stop bad actors from kicking the entire server for no reason

putting your anti exploit on clientside is already huge vulnerability since exploiters have the power to do anything before it runs (depends on the exploit)