It was recently discovered that when doing a specific action with animations, the message regarding the animation will not be filtered. Recent roblox changes have filtered rbxassetid:// messages, then active:// could be used to bypass that. Active:// was patched, and now this method exists.
For safety, I will only include the repro code in the private content field, but I can’t really stop people from abusing this now that the method is known publicly especially in the exploiting community.
To anticheat developers: since this was leaked, just check for “animation:” in the text. I’m not sharing the repro script but if you filter out anything with that text, any potential false bans will stop. You should really just disable your messageout checks or use hard-coded strings instead of pattern matching. I’m not your parent but this has happened 3 times in different ways so there’s probably some other way to do it too. Remember to also filter out :// in case there’s some other way to do it. rbxassetid:// was only used here for an example and they can add warnings to the console without it.
Expected behavior
Assetids should be filtered in the warning, just like they’re filtered in LoadAnimation():Play().
The original ID as always should be sent to the server from the animationplayed signal, as many people use it to send data without remotes. Changing this will break many people’s remoteless networking.
This was also reported on hackerone by the person whose game was affected @ Report ID #4055020
The dev console is pretty much harmless if exploited. The real risk is if a method regarding the server command bar gets a way to access to command bar meaning exploiters would be able to execute require or serversided code such as seen in the Robot Right Leg vulnerability which its file was kept private to the DEX Agency (Zinnia, and a bunch of others regarding harkinian_hax). eitherway the game wont be moderated if it only appears in that specific console since it is internal.
The greater concern here is that some big games have incorporated anticheats that use log detections to detect scripts being ran or executors being injected. These unsanitized messages can be used to falsely ban people by inserting intentionally-detected message patterns (perhaps like “Injected” or “Loaded”) into their consoles.
This is a misrepresentation. Many games have anticheats coded by the developers to check for console output. I also brought it up as my exact point at the bottom and not the fact that it can be used to flood log files.
I am also aware of the robot right leg incident , but please understand 2 things can be bad at once. This is very low severity but the people who have been abusing it are genuinely comically evil and set a date of 8pm cst to run a false banwave in a game. They also set up a sql database to log every player that was banned, and there was a goant discord server full of people who were going to run multiple accounts to cause false bans.
Anticheat developers need to stop detecting messageout, and yeah this probably also affects Adonis so a ton of other games. As I said, there’s other protocols that don’t use ://, so just checking for that isn’t enough. Messageout detections in general are pretty terrible and using pattern matching is worse
Also, if roblox didn’t see it as an issue, they wouldn’t have patched it twice. There’s no need to try to one-up me on an issue multiple roblox staff confirmed should be fixed.
a predator can put a link or their discord user in there then go around asking kids to press F9, dev console opens with just one keybind, it’s practically a filter bypass and makes it way easier to move potential children off platform to third party sites
at worst this could genuinely be a safety issue, it’s unlikely, but possible
roblox cmon and patch this already, it cannot be that difficult, a kid could easily open the console intentionally or accidentally and see completely unfiltered messages posted by random people
like yeah devs can write unfiltered stuff into the console themselves but at least moderation can view whatever script is printing stuff
Many scripts and executors do use prints at one point or another. The problem is people use pattern matching. The reason behind this is the dual-purpose is looking for error logs, but people usually don’t filter by the exact message type and the exact content. Like a few ones have, an executor randomizing its script name will have a different traceback in the error message every time. This requires making a custom regex pattern for the executor, or to be lazy, using string.find
It’s a safety nightmare if people decide to convert ascii art into an error message, ie swastikas (has happened before, but usually in chat), nsfl, or as I showed in the demo, offsite links. Really anything that can be used to show people uncensored content will be used to show people uncensored content. Roblox should’ve reviewed every entry point for this stuff when they fixed it the other 2 times. There’s probably even some raknet packets exploiters can send that just hasn’t been discovered yet.
I’m also sorry this got leaked following my post, causing a false ban wave in Project Delta (as seen in my other message) and giving the entire exploiting community access to it. I was told to make a bug report and it’s just the aftermath. Game developers unfortunately have to deal with this until roblox gives developers better ways to identify exploiters without having to write their own dangerous anticheats.
I’m not going to share the code here still, but I’ll put a simple fix for it on the thread
If a good portion of your job relied on being in the exploiting community you’d be in the exploiting community. Most people wouldn’t know Luraph is deobfuscated unless they were in that community sering the billion posts about it.
The fact you add irrelevant groups to this post is very ironical. Aequalis / lightwizard are just some dumb groups about trolling on washiez. Justice violet is just a group of a friend. Suggest you research before going allat just cuz i also dev outside of studio🤣
