Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

gist.github.com

Post reply on HN
Print view View original

171–180 of 453 posts

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#171

Post by exceptione »

rcxdude wrote: post #161
poorman wrote: post #20

Earlier quoted context omitted.

All SVGs should be properly sanitized going into a backend and out of it and when rendered on a page. Do you allow SVGs to be uploaded anywhere on your site? This is a PSA that you're probably at risk unless you can find the few hundred lines of code doing the sanitization. Note to Ruby on Rails developers, your active storage uploaded SVGs are not sanitized by default.

Sanitisation is a tricky process, it can be real easy for something to slip through the cracks.

I guess it is a matter of parsing svg. Trying to hack around with regex is asking for trouble indeed.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#172

Post by viraptor »

JackSlateur wrote: post #39

I struggle to understand the issue .. could someone help me out ? Ok, you got " https://discord.com/_mintlify/_static/hackerone-a00f3c6c/lma... " to send a controlled payload But regular users will never hit " https://discord.com/_mintlify/_static/hackerone-a00f3c6c/lma... ", so they will never execute your script I fail to understand how this can be exploited, by whom and in what conditions

It's hosted on the official domain. That means you have at least 2 options: a) chain in with another issue which allows to load that as a trusted resource, or b) scam people by directing them to an "official" post. Also you get discord cookies access.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#173

Post by arcwhite »

tuhgdetzhh wrote: post #162
tptacek wrote: post #146

Earlier quoted context omitted.

No it would not have been.

Could you elaborate on why not?

There's generally no grey market for XSS vulns. The people buying operationalized exploits generally want things that they can aim very specifically to achieve an outcome against a particular target, without that target knowing about it, and operationalized XSS vulns seldom have that nature.

Your other potential buyers are malware distributors and scammers, who usually want a vuln that has some staying power (e.g. years of exploitability). This one is pretty clearly time-limited once it becomes apparent.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#174

Post by jgeralnik »

jonahx wrote: post #156
tptacek wrote: post #131

Earlier quoted context omitted.

I'm happy to answer questions but the only thing I could think to respond with here is just a restatement of what I said. I was terse; which part do you want me to expand on? Sorry about that!

> because there aren't existing business processes those vulnerabilities drop seamlessly into; they're all situational and time-sensitive. what's an example of an existing business process that would make them valuable, just in theory? why do they not exist for xss vulns? why, and in what sense, are they only situational and time-sensitive? i know you're an expert in this field. i'm not doubting the assertions just t…

A remote code execution bug in ios is valuable - it may take a long time to detect exploitation (potentially years if used carefully), and even after being discovered there is a long tail of devices that take time to update (although less so than on android, or linux run on embedded devices that can’t be updated) That’s why it’s worth millions on the black market and apple will pay you $2 million dollars for it

An XSS is much harder to exploit quietly (the server can log everything), and can be closed immediately 100% with no long tail. At the push of an update the vulnerability is now worth zero. Someone paying to purchase an XSS is probably intending to use it once (with a large blast radius) and get as much as they can from it in the time until it is closed (hours? maybe days?)

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#175

Post by kevin_thibedeau »

fainpul wrote: post #32
dllu wrote: post #5

The fact that SVG files can contain scripts was a bit of a mistake. On one hand, the animations and entire interactive demos and even games in a single SVG are cool. But on the other hand, it opens up a serious can of worms of security vulnerabilities. As a result, SVG files are often banned from various image upload tools, they do not unfurl previews, and so on. If you upload an SVG to discord, it just shows the raw…

"The script doesn't run unless the file is directly opened (you can't run scripts from ( )."

It will run if its in an tag.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#176

Post by arpinum »

multisport wrote: post #55

decided to make a new account to post: Mintlify security is the worse I have even encountered in a modern SaaS company. They will leak your data, code, assets, etc. They will know they did this. You will tell them, they will acknowledge that they knew it happened, and didn't tell you. Your docs site will go down, and you will need to page their engineers to tell them its down. This will be a surprise to them.

Yes, they were sloppy with GitHub credentials and their response was inadequate. Glad we migrated away from them.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#177

Post by kevin_thibedeau »

moss_dog wrote: post #103
eastbound wrote: post #71

Earlier quoted context omitted.

It’s wild how often specs are ok for 9 versions, and then at version 10, standard bodies decide to transform them into a trojan firehose. It’s so regular like clockwork that it has to be a nation state doing this to us.

Any notable examples you can share?

PDF was purposely a non-Turing adaptation of PostScript. Then they added JavaScript support.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#178

Post by jdsleppy »

superasn wrote: post #128

This is a pretty scary exploit, considering how easily it could be abused. Imagine just one link in a tweet, support ticket, or email: https://discord.com/_mintlify/static/evil/exploit.svg . If you click it, JavaScript runs on the discord.com origin. Here's what could happen: - Your Discord session cookies and token could be stolen, leading to a complete account takeover. - read/write your developer applications & we…

Doesn't stealing the cookies/token require a non-HTTP-only session cookie or a token in localstorage? Do you know that Discord puts their secrets in one of those insecure places, or was it just a guess?

I believe if you always keep session cookies in secure, HTTP-only cookies, then you are more resilient to this attack.

I interviewed frontend devs last year and was shocked how few knew about this stuff.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#179

Post by MarsIronPI »

demurgos wrote: post #27
bobbylarrybobby wrote: post #15

Earlier quoted context omitted.

Would it be possible for messenger apps to simply ignore tags (and accept that this will break a small fraction of SVGs)? Or is that not a sufficient defense?

I looked into it for work at some point as we wanted to support SVG uploads. Stripping is not enough to have an inert file. Scripts can also be attached as attributes. If you want to prevent external resources it gets more complex. The only reliable solution would be an allowlist of safe elements and attributes, but it would quickly cause compat issues unless you spend time curating the rules. I did not find an exist…

Shouldn't the ignoring of scripting be done at the user agent level? Maybe some kind of HTTP header to allow sites to disable scripts in SVG ala CORS?

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#180

Post by PenguinCoder »

mpeg wrote: post #168
Lionga wrote: post #163

Earlier quoted context omitted.

It would have been. Ten times the amount at least.

For a reflected XSS? Tell me who is paying that much for such a relatively common bug... To elaborate, to exploit this you have to convince your target to open a specially crafted link which would look very suspect. The most realistic way to exploit would be to send a shortened link and hope they click on it, that they are logged into discord.com when they do (most people use the app), that there are no other securit…

It isn't about the commonality of the bug, but the level of access it gets you on the type or massive scale of the target. This bug you your blog? Who cares. This bug on Discord or AWS? Much more attractive and lucrative.
Post reply on HN