Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

gist.github.com

Post reply on HN
Print view View original

111–120 of 453 posts

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#111

Post by gkoberger »

bri3d wrote: post #11

Proxying from the "hot" domain (with user credentials) to a third party service is always going to be an awful idea. Why not just CNAME Mintlify to dev-docs.discord.com or something? This is also why an `app.` or even better `tenant.` subdomain is always a good idea; it limits the blast radius of mistakes like this.

I run a product similar to Mintlify.

We've made different product decisions than them. We don't support this, nor do we request access to codebases for Git sync. Both are security issues waiting to happen, no matter how much customers want them.

The reason people want it, though, is for SEO: whether it's true or outdated voodoo, almost everyone believes having their documentation on a subdomain hurts the parent domain. Google says it's not true, SEO experts say it is.

I wish Mintlify the best here – it's stressful to let customers down like this.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#112

Post by rainonmoon »

hackermondev wrote: post #94
rainonmoon wrote: post #70

Earlier quoted context omitted.

Nice! So the Cookie is accessible by JavaScript on all of those sites? That would be pretty surprising given the prevalence of HttpOnly, so that doesn't seem clear to me at all. And they're all using Cookie-based auth, you think? You're a bug bounty hunter so I'll defer to your wisdom, but doesn't it seem more likely that an account takeover would be possible via a state-changing request from the user's existing sess…

the impact varied by customer. in Discord's case, the auth token is stored in local storage and their docs is hosted on the primary domain; they were susceptible to a full account takeover. X's docs are on a different subdomain but we found a CSRF attack that could facilitate a full account takeover. most companies were significantly affected in one way or another.

And to my earlier point, none of that is in the writeup here to support the enormous claims made in framing the finding. This is good work, and congratulations on the bounty. I hope you have a long career in security ahead. Obviously you communicated your findings to Discord clearly enough for them to understand the impact. I look forward to reading more research from you all in the future and I hope the technical details will accompany it.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#113

Post by gnerd00 »

hinkley wrote: post #49
aidenn0 wrote: post #44

Earlier quoted context omitted.

External entities in XML[1] were a similar issue back when everyone was using XML for everything, and parsers processed external-entities by default. 1: https://owasp.org/www-community/vulnerabilities/XML_External...

At least with external entities you could deny the parser an internet connection and force it to only load external documents from a cache you prepopulated and vetted. Turing completeness is a bullshit idea in document formats.

calling Leonard Rosenthol ...

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#114

Post by wiether »

0xbadcafebee wrote: post #40

How these companies don't hire kids like Daniel for pennies on the dollar and have him attack their stacks on a loop baffles me. Pay the kid $50k/yr (part time, he still needs to go to school) to constantly probe your crappy stacks. Within a year or two you'll have the most goddamn secure company on the internet - and no public vulns to embarrass you.

That's a bit simplistic.

If you sign a contract with a "hacker", then you are expecting results. Otherwise how do you decide to renew the contract next year? How do you decide to raise it next year? What if, during this contract, a vulnerability that this individual didn't found is exploited? You get rid of them?

So you're putting pressure on a person who is a researcher, not a producer. Which is wrong.

And also there's the scale. Sure, here you have one guy who exploited a vulnerability. But how long it took them to get there? There's probably dozens of vulnerabilities yet to be exploited, requiring skills that differ so much from the ones used by this person that they won't find them. Even if you pay them for a full-time position.

Whereas, if you set up a bug bounty program, you are basically crowdsourcing your vulnerabilities: not only you probably have thousands of people actively trying to exploit vulnerabilities in your system, but also, you only give money to the ones that do manage to exploit one. You're only paying on result.

Obviously, if the reward is not big enough, they could be tempted to sell them to someone else or use them themselves. But the risk is here no matter how you decide to handle this topic.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#115

Post by bbarn »

ascorbic wrote: post #46
finghin wrote: post #36

Earlier quoted context omitted.

I hope I'm not assuming too much but I'm really hope the up and coming hacker is smart enough to know that his work was worth more than $4,000. That's 1-2% of an annual SE salary for someone with similar skillset.

And this will help them land that six figure job

I mean, as a hiring manager, a fresh grad with multiple bug bounties tells me a lot about their drive and skill, so I'd agree. It's a great differentiator.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#116

Post by hinkley »

actionfromafar wrote: post #106
hinkley wrote: post #49

Earlier quoted context omitted.

At least with external entities you could deny the parser an internet connection and force it to only load external documents from a cache you prepopulated and vetted. Turing completeness is a bullshit idea in document formats.

Postscript is pretty neat IMHO and it’s Turing complete. I really appreciated my raytraced page finally coming out of that poor HP laser after an hour or so.

One of the very first SVG documents I encountered was a port of the PS Tiger to SVG. It loaded a lot faster than the PostScript Tiger.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#117

Post by lowkey_ »

lrvick wrote: post #108
jijijijij wrote: post #96

Earlier quoted context omitted.

> Unfortunately a competitive rate agreed to in advance with a company before we do any pentesting is the only way we have ever been able to get paid fairly for this sort of work. So, rough estimate, how much would you have made for this?

We normally find things like this in our usual 60 hour audit blocks. Rates change over time with demand, but today an audit of that length would be $27k. Even that is quite cheap compared to letting a blackhat find this.

If I can ask on business model, as I have a friend with a similar predicament — what percent of the time do you find vulnerabilities in those audits? Do companies push back if you don't find vulnerabilities?

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#118

Post by Wowfunhappy »

dllu wrote: post #5

The fact that SVG files can contain scripts was a bit of a mistake. On one hand, the animations and entire interactive demos and even games in a single SVG are cool. But on the other hand, it opens up a serious can of worms of security vulnerabilities. As a result, SVG files are often banned from various image upload tools, they do not unfurl previews, and so on. If you upload an SVG to discord, it just shows the raw…

IMO, the bigger problem with SVGs as an image format is that different software often renders them (very) differently! It's a class of problem that raster image formats basically don't have.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#119

Post by sammy2255 »

wiether wrote: post #114
0xbadcafebee wrote: post #40

How these companies don't hire kids like Daniel for pennies on the dollar and have him attack their stacks on a loop baffles me. Pay the kid $50k/yr (part time, he still needs to go to school) to constantly probe your crappy stacks. Within a year or two you'll have the most goddamn secure company on the internet - and no public vulns to embarrass you.

That's a bit simplistic. If you sign a contract with a "hacker", then you are expecting results. Otherwise how do you decide to renew the contract next year? How do you decide to raise it next year? What if, during this contract, a vulnerability that this individual didn't found is exploited? You get rid of them? So you're putting pressure on a person who is a researcher, not a producer. Which is wrong. And also ther…

They've already proved themselves as competent. $50k a year to a billion dollar company is nothing. Even if they find 0 vulnerabilities a year it's still worth it to them

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#120

Post by css_apologist »

dllu wrote: post #5

The fact that SVG files can contain scripts was a bit of a mistake. On one hand, the animations and entire interactive demos and even games in a single SVG are cool. But on the other hand, it opens up a serious can of worms of security vulnerabilities. As a result, SVG files are often banned from various image upload tools, they do not unfurl previews, and so on. If you upload an SVG to discord, it just shows the raw…

is santizing SVGs hard, or just everyone forgets they can contain js?
Post reply on HN