Skip to content

Conversation

@Maximus7474
Copy link

Current ox_inventory version (v2.44.6) has a vulnerability where users can open any inventory bypassing all security checks.
This is due to there not being any validation made on the invType parameter within the openInventory function & callback.

As discussed with Linden ideal solution to allow customization with relative ease without needing to add inventory types to a separate registry, before opening another inventory check that the requested invType is equal to the inventory type. This will lead to false positives, but is only applicable to poorly created integrations where developers aren't paying attention to what they're passing as arguments.
Being that most occurrences of this would be due to people trying to exploit it, I kept the nice DropPlayer in there, can switch it to a warn log via ox_lib if judged to harsh or alter the reasons.

This can be replicated by adding the following code to demonstrate the lack of injection protection of fxserver by overriding the closeInventory function (preventing the inventory from closing due to failed security checks) and passing invalid arguments to the server to open any inventory.

RegisterCommand('injectshit', function()
    client.closeInventory = function() end

    -- 'valid_inv_id' can also be a number for targeting a player inventory
    --  'invalid_invType' can be any string excluding a used value for inventory types
    --     i.e. 'fuckwits_are_annoying', 'kek'
    --     but not 'trunk', 'player' obv...
    TriggerEvent('ox_inventory:openInventory', 'invalid_invType', 'valid_inv_id')
end)

-> allows users to open inventories by passing the incorrect invType regardless of distance and security checks
@FjamZoo
Copy link

FjamZoo commented Sep 13, 2025

I think keeping it as a DropPlayer is overall beneficial enough as there shouldn't really be any instances of this happening without poor development or straight cheater.

thanks for the pr boss

@FjamZoo FjamZoo merged commit a7927aa into CommunityOx:main Sep 13, 2025
This was referenced Sep 13, 2025
Maximus7474 added a commit to Maximus7474/ox_inventory that referenced this pull request Sep 17, 2025
…which did not cover the type missmatch for temporary stashes
Maximus7474 added a commit to Maximus7474/ox_inventory that referenced this pull request Sep 17, 2025
…ot cover the type missmatch for temporary stashes
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants