Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

gist.github.com

Post reply on HN
Print view View original

121–130 of 453 posts

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#121

Post by hoppp »

dllu wrote: post #5

The fact that SVG files can contain scripts was a bit of a mistake. On one hand, the animations and entire interactive demos and even games in a single SVG are cool. But on the other hand, it opens up a serious can of worms of security vulnerabilities. As a result, SVG files are often banned from various image upload tools, they do not unfurl previews, and so on. If you upload an SVG to discord, it just shows the raw…

I agree, when animating SVGs I never put the js inside them so having the ability embed it is just dangerious I think

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#122

Post by zffr »

Wowfunhappy wrote: post #118
dllu wrote: post #5

The fact that SVG files can contain scripts was a bit of a mistake. On one hand, the animations and entire interactive demos and even games in a single SVG are cool. But on the other hand, it opens up a serious can of worms of security vulnerabilities. As a result, SVG files are often banned from various image upload tools, they do not unfurl previews, and so on. If you upload an SVG to discord, it just shows the raw…

IMO, the bigger problem with SVGs as an image format is that different software often renders them (very) differently! It's a class of problem that raster image formats basically don't have.

I would have expected SVGs to be like PDFs and render the same across devices. Is the issue that some renderers don’t implement the full spec, or that some implement parts incorrectly?

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#123

Post by omneity »

gkoberger wrote: post #111
bri3d wrote: post #11

Proxying from the "hot" domain (with user credentials) to a third party service is always going to be an awful idea. Why not just CNAME Mintlify to dev-docs.discord.com or something? This is also why an `app.` or even better `tenant.` subdomain is always a good idea; it limits the blast radius of mistakes like this.

I run a product similar to Mintlify. We've made different product decisions than them. We don't support this, nor do we request access to codebases for Git sync. Both are security issues waiting to happen, no matter how much customers want them. The reason people want it, though, is for SEO: whether it's true or outdated voodoo, almost everyone believes having their documentation on a subdomain hurts the parent domai…

To my knowledge it's not as much hurting the parent domain as having two separate "worlds". Your docs which are likely to receive higher traffic will stop contributing any SEO juice to your main website.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#124

Post by rafram »

azemetre wrote: post #31
da_grift_shift wrote: post #17

Earlier quoted context omitted.

>Also not much excuse for xss these days. XSS is not dead, and the web platforms mitigations (setHTML, Trusted Types) are not a panacea. CSP helps but is often configured poorly. So, this kind of widespread XSS in a vulnerable third party component is indeed concerning. For another example, there have been two reflected XSS vulns found in Anubis this year, putting any website that deploys it and doesn't patch at risk…

Is it really fair to compare an open source project that desperately wants only $60k a year to hire a dev with companies that have collectively raised over billions of dollars in funding?

I think it’s very fair. Anubis generated a lot of buzz in tech communities like this one, and developers pushed it to production without taking a serious look at what it’s doing on their server. It’s a very flawed piece of software that doesn’t even do a good job at the task it’s meant for (don’t forget that it doesn’t touch any request without “Mozilla” in the UA). If some security criticism gets people to uninstall it, good.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#125

Post by jijijijij »

tptacek wrote: post #88
jijijijij wrote: post #62

Earlier quoted context omitted.

If a $500 drone is coming for your $100M factory, the price limit for defense considerations isn't $500. In the end, you are trying to encourage people not to fuck with your shit, instead of playing economic games. Especially with a bunch of teenagers who wouldn't even be fully criminally liable for doing something funny. $4K isn't much today, even for a teenager. Thanks to stupid AI shit like Mintlify, that's like w…

That's not how any of this works. A price for a vulnerability tracking the worst-case outcome of that vulnerability isn't a bounty or a market-clearing price; it's a shakedown fee. Meanwhile: the actual market-clearing price of an XSS vulnerability is very low (in most cases, it doesn't exist at all) because there aren't existing business processes those vulnerabilities drop seamlessly into; they're all situational a…

> That's not how any of this works.

Yes, evidently not.

Just because on average the intelligence agencies or ransom ware distributors wouldn't pay big bucks for XSS on Zerodium etc. doesn't mean that's setting the fair, or wise price for disclosure. Every bug bounty program is mostly PR mitigation. It's bad PR if you underpay for a disclosed vulnerability, which may have ended your business, considering the price of security audits/practices you cheaped out on. I mean, most bug bounty programs are actually paid by scope, not market price for technically comparable exploits. If you found an XSS vulnerability in an Apple service with this scope, I bet you would have been paid more than 4k.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#126

Post by marisen »

Given this (including the linked writeup on the mintlify RCE), after the React RCE, if think it should be pretty obvious that

1. content security policies should always be used to prevent such scripts (here they would prevent execution of scripts from the SVG)

2. The JavaScript ecosystem should be making ` --disallow-code-generation-from-strings` a default recommendation when running NodeJS on the server.

Vercel (and other nodejs as a service providers) should warn customers that don't use CSP and `--disallow-code-generation-from-strings` that their settings should be improved.

There are a bunch of other NodeJS flags that maybe you should look into too: https://sgued.fr/blog/react-rce/#node-js-mitigations

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#127

Post by tptacek »

jijijijij wrote: post #125
tptacek wrote: post #88

Earlier quoted context omitted.

That's not how any of this works. A price for a vulnerability tracking the worst-case outcome of that vulnerability isn't a bounty or a market-clearing price; it's a shakedown fee. Meanwhile: the actual market-clearing price of an XSS vulnerability is very low (in most cases, it doesn't exist at all) because there aren't existing business processes those vulnerabilities drop seamlessly into; they're all situational a…

> That's not how any of this works. Yes, evidently not. Just because on average the intelligence agencies or ransom ware distributors wouldn't pay big bucks for XSS on Zerodium etc. doesn't mean that's setting the fair, or wise price for disclosure. Every bug bounty program is mostly PR mitigation. It's bad PR if you underpay for a disclosed vulnerability, which may have ended your business, considering the price of…

Nobody is buying anything on "Zerodium".

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#128

Post by superasn »

This is a pretty scary exploit, considering how easily it could be abused.

Imagine just one link in a tweet, support ticket, or email: https://discord.com/_mintlify/static/evil/exploit.svg. If you click it, JavaScript runs on the discord.com origin.

Here's what could happen:

- Your Discord session cookies and token could be stolen, leading to a complete account takeover.

- read/write your developer applications & webhooks, allowing them to add or modify bots, reset secrets, and push malicious updates to millions.

- access any Discord API endpoint as you, meaning they could join or delete servers, DM friends, or even buy Nitro with your saved payment info.

- maybe even harvest OAuth tokens from sites that use "Login with Disord."

Given the potential damage, the $4,000 bounty feels like a slap in the face.

edit: just noticed how HN just turned this into a clickable link - this makes it even scarier!

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#129

Post by Sohcahtoa82 »

aidenn0 wrote: post #44
dllu wrote: post #5

The fact that SVG files can contain scripts was a bit of a mistake. On one hand, the animations and entire interactive demos and even games in a single SVG are cool. But on the other hand, it opens up a serious can of worms of security vulnerabilities. As a result, SVG files are often banned from various image upload tools, they do not unfurl previews, and so on. If you upload an SVG to discord, it just shows the raw…

External entities in XML[1] were a similar issue back when everyone was using XML for everything, and parsers processed external-entities by default. 1: https://owasp.org/www-community/vulnerabilities/XML_External...

XXE should have never existed.

Whoever decided it should be enabled by default should be put into some sort of cybersecurity jail.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#130

Post by tptacek »

azemetre wrote: post #95
tptacek wrote: post #45

Earlier quoted context omitted.

Can you cite a source for that claim? The USG paying mid-5-figures for an XSS vulnerability? That's news to me.

The book "This Is How They Tell Me the World Ends" by Nicole Perlroth, while it's about the history of cyberweapons it does a very good job detailing the late 90s to early 2010s exploit market. I don't have it in front of me, but I'm talking about the "nobody but us" era of exploit markets: https://en.wikipedia.org/wiki/NOBUS Where the NSA seemingly was buying anything, even if not worthwhile, as a form of "munitions…

I haven't read her book, am myself somewhat read in to the background here, and if she's claiming NSA was stockpiling serverside web bugs, I do not believe her.

In reality, intelligence agencies today don't even really stockpile mobile platform RCE. The economics and logistics are counterintuitive. Most of the money is made on the "backend", in support/update costs, paid in tranches; CNE vendors have to work hard to keep up with the platforms even when their bugs aren't getting burned. We interviewed Mark Dowd about this last year for the SCW podcast.

Post reply on HN