Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

gist.github.com

Post reply on HN
Print view View original

161–170 of 453 posts

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#161

Post by rcxdude »

poorman wrote: post #20
dllu wrote: post #5

The fact that SVG files can contain scripts was a bit of a mistake. On one hand, the animations and entire interactive demos and even games in a single SVG are cool. But on the other hand, it opens up a serious can of worms of security vulnerabilities. As a result, SVG files are often banned from various image upload tools, they do not unfurl previews, and so on. If you upload an SVG to discord, it just shows the raw…

All SVGs should be properly sanitized going into a backend and out of it and when rendered on a page. Do you allow SVGs to be uploaded anywhere on your site? This is a PSA that you're probably at risk unless you can find the few hundred lines of code doing the sanitization. Note to Ruby on Rails developers, your active storage uploaded SVGs are not sanitized by default.

Sanitisation is a tricky process, it can be real easy for something to slip through the cracks.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#162

Post by tuhgdetzhh »

tptacek wrote: post #146
snvzz wrote: post #133

Earlier quoted context omitted.

>the $4,000 bounty feels like a slap in the face. And serves a reminder crime does pay. In the black market, it would have been worth a bit more.

No it would not have been.

Could you elaborate on why not?

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#163

Post by Lionga »

tptacek wrote: post #146
snvzz wrote: post #133

Earlier quoted context omitted.

>the $4,000 bounty feels like a slap in the face. And serves a reminder crime does pay. In the black market, it would have been worth a bit more.

No it would not have been.

It would have been. Ten times the amount at least.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#164

Post by anthk »

aydyn wrote: post #51
dllu wrote: post #5

The fact that SVG files can contain scripts was a bit of a mistake. On one hand, the animations and entire interactive demos and even games in a single SVG are cool. But on the other hand, it opens up a serious can of worms of security vulnerabilities. As a result, SVG files are often banned from various image upload tools, they do not unfurl previews, and so on. If you upload an SVG to discord, it just shows the raw…

There is: PDF. You may not like it or adobe, but its there and widely supported.

Better a DJVU file generated at a high DPI.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#165

Post by macNchz »

tptacek wrote: post #41
llmslave2 wrote: post #22

This feels so emblematic of our current era. VC funded vibe coded AI documentation startup somehow gets big name customers who don't properly vet the security of the platform, ship a massive vulnerability that could pwn millions of users and the person who reports the vulnerability gets...$5k. If I recall last week Mintlify wrote a blog post showcasing their impressive(ly complicated) caching architecture. Pretending…

I don't think anybody in SFBA-style software development, both pre- and post-LLM, is really resilient against these kinds of attacks. The problem isn't vibe coding so much as it is multiparty DLL-hell dependency stacks, which is something I attribute more to Javascript culture than to any recent advance in technology.

I do occasionally wonder how different things would be if JavaScript had come with a very robust standard library from early on.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#166

Post by lelandfe »

rcxdude wrote: post #161
poorman wrote: post #20

Earlier quoted context omitted.

All SVGs should be properly sanitized going into a backend and out of it and when rendered on a page. Do you allow SVGs to be uploaded anywhere on your site? This is a PSA that you're probably at risk unless you can find the few hundred lines of code doing the sanitization. Note to Ruby on Rails developers, your active storage uploaded SVGs are not sanitized by default.

Sanitisation is a tricky process, it can be real easy for something to slip through the cracks.

Yeah I’ve worked on a few pieces of software now that tried SVG sanitizing on uploads, got hacked, and banned the uploads.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#167

Post by bangaladore »

hackermondev wrote: post #94
rainonmoon wrote: post #70

Earlier quoted context omitted.

Nice! So the Cookie is accessible by JavaScript on all of those sites? That would be pretty surprising given the prevalence of HttpOnly, so that doesn't seem clear to me at all. And they're all using Cookie-based auth, you think? You're a bug bounty hunter so I'll defer to your wisdom, but doesn't it seem more likely that an account takeover would be possible via a state-changing request from the user's existing sess…

the impact varied by customer. in Discord's case, the auth token is stored in local storage and their docs is hosted on the primary domain; they were susceptible to a full account takeover. X's docs are on a different subdomain but we found a CSRF attack that could facilitate a full account takeover. most companies were significantly affected in one way or another.

Interesting. I agree with the other commenter about the post should've included how an account takeover was possible.

You mention one method being a cookie sent to an attacker-controlled domain, but that in itself is a vulnerability given it being incorrectly scoped (missing HTTPOnly & SameSite atleast).

> the auth token is stored in local storage

Has anyone reported this (rhetorical question)? What in the world could be the justification for this?

In my opinion, any full account takeovers due to XSS is a vulnerability, even ignoring XSS. Changing email/password/phone should require verification back to one of those methods. Or at least input of the previous password.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#168

Post by mpeg »

Lionga wrote: post #163
tptacek wrote: post #146

Earlier quoted context omitted.

No it would not have been.

It would have been. Ten times the amount at least.

For a reflected XSS? Tell me who is paying that much for such a relatively common bug...

To elaborate, to exploit this you have to convince your target to open a specially crafted link which would look very suspect. The most realistic way to exploit would be to send a shortened link and hope they click on it, that they are logged into discord.com when they do (most people use the app), that there are no other security measures (httponly cookies) etc

No real way to use this to compromise a large amount of users without more complex means

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#169

Post by grenran »

tuesdaynight wrote: post #8
FloorEgg wrote: post #6

Earlier quoted context omitted.

Supply and demand I guess. Pathetic for a senior SE but pretty awesome for a 16 year old up and coming hacker.

You are right, but that could (probably not) make them go for the bad route because they would get way more money that way. 4k for a bug that could take control of your customer account sounds disrespectful to me.

Playing devils advocate but 4k is probably more money than most kids that age have seen in their life
Post reply on HN