Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

gist.github.com

Post reply on HN
Print view View original

221–230 of 453 posts

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#221

Post by Sohcahtoa82 »

quasarj wrote: post #72

One of these days I'm gonna have to learn why cross-site scripting even matters, especially with modern browsers restricting a script's access to anything local

The attacker can do anything using your session.

The "Hello world" examples always show using it to steal your cookies, which obviously doesn't work now when nearly every site uses the "httpOnly" flag which makes the cookie inaccessible to JavaScript, but really, stealing your session isn't necessary. They just have to make the XSS payload run the necessary JavaScript.

Once the JavaScript is running on the page, all bets are off. They can do ANYTHING that the page can do, because now they can make HTTP requests on your behalf. SOP no longer applies. CSRF no longer protects you. The attacker has full control of your account, and all the requests will appear to come from YOUR browser.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#222

Post by 0x3f »

rvnx wrote: post #216
mpeg wrote: post #187

Earlier quoted context omitted.

Yes, but this is not a particularly high access level bug. Depending on the target, it's possible that the most damage you could do with this bug is a phishing attack where the user is presented a fake sign-in form (on a sketchy url) I think $4k is a fair amount, I've done hackerone bounties too and we got less than that years ago for a twitter reflected xss

Why would that be the maximum damage ? This XSS is particularly dangerous because you are running your script on the same domain where the user is logged-in so you can pretty much do anything you want under his session. In addition this is widespread. It's golden for any attacker.

Because modern cookie directives and browser configs neuter a lot of the worst XSS outcomes/easiest exploit paths. I would expect all the big sites to be setting them, though I guess you never know.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#223

Post by rvnx »

0x3f wrote: post #222
rvnx wrote: post #216

Earlier quoted context omitted.

Why would that be the maximum damage ? This XSS is particularly dangerous because you are running your script on the same domain where the user is logged-in so you can pretty much do anything you want under his session. In addition this is widespread. It's golden for any attacker.

Because modern cookie directives and browser configs neuter a lot of the worst XSS outcomes/easiest exploit paths. I would expect all the big sites to be setting them, though I guess you never know.

I would not be that confident as you can see: on their first example, they show Discord and the XSS code is directly executed on Discord.com under the logged-in account (some people actually use web version of Discord to chat, or sign-in on the website for whatever reason).

If you have a high-value target, it is a great opportunity to use such exploits, even for single shots (it would likely not be detected anyway since it's a drop in the ocean of requests).

Spreading it on the whole internet is not a good strategy, but for 4000 USD, being able to target few users is a great value.

Besides XSS, phishing has its own opportunity.

Example: Coinbase is affected too though on the docs subdomain and there are 2-step, so you cannot do transactions directly but if you just replace the content with a "Sign-in to Coinbase / Follow this documentation procedure / Download update", this can get very very profitable.

Someone would pay 4000 USD to receive 500'000 USD back in stolen bitcoins).

Still, purely with executing things under the user sessions there are interesting things to do.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#224

Post by notnullorvoid »

tptacek wrote: post #146
snvzz wrote: post #133

Earlier quoted context omitted.

>the $4,000 bounty feels like a slap in the face. And serves a reminder crime does pay. In the black market, it would have been worth a bit more.

No it would not have been.

This specific XSS vulnerability may not have been, but the linked RCE vulnerability found by their friend https://kibty.town/blog/mintlify/ certainly would've been worth more than the $5,000 they were awarded.

A vulnerability like that (or even a slightly worse XSS that allowed serving js instead of only svg) could've let them register service workers to all visiting users giving future XSS ability at any time, even after the original RCE and XSS were patched.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#225

Post by eek2121 »

lenzm wrote: post #148
zffr wrote: post #122

Earlier quoted context omitted.

I would have expected SVGs to be like PDFs and render the same across devices. Is the issue that some renderers don’t implement the full spec, or that some implement parts incorrectly?

They are like PDFs in that they do not render the same with different software or on different devices.

You definitely don't understand PDFs, let alone SVGs.

PDFs can also contain scripts. Many applications have had issues rendering PDFs.

Don't get me wrong, the folks creating the SVG standard should've used their heads. This is like the 5th time (that I am aware of) this type of issue has happened, (and at least 3 of them were Adobe). Allowing executable code in an image/page format shouldn't be a thing.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#226

Post by [deleted] »

css_apologist wrote: post #200
rslashuser wrote: post #182

Earlier quoted context omitted.

I gather from the HN discussion that it's not simple to disable scripting in an SVG, in retrospect a tragically missing feature. I guess the next step is to propose a simple "noscripting" attribute, which if present in the root of the SVG doc inhibits all scripting by conforming renderers. Then the renderer layer at runtime could also take a noscripting option, so the rendering context could force it if appropriate.…

its common to santize html string to parse it and remove/error on script tags (and other possible vulnerabilities) i wonder do people not do this with svgs?

[deleted]

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#227

Post by why-o-why »

superasn wrote: post #128

This is a pretty scary exploit, considering how easily it could be abused. Imagine just one link in a tweet, support ticket, or email: https://discord.com/_mintlify/static/evil/exploit.svg . If you click it, JavaScript runs on the discord.com origin. Here's what could happen: - Your Discord session cookies and token could be stolen, leading to a complete account takeover. - read/write your developer applications & we…

The fact that it is just so trivial and obvious that its scary. It didn't even require any real hacking chops, just patience: literally anyone with a cursory knowledge of site design could have stumbled on this if they were looking at it.

Terrifying.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#228

Post by tptacek »

notnullorvoid wrote: post #224
tptacek wrote: post #146

Earlier quoted context omitted.

No it would not have been.

This specific XSS vulnerability may not have been, but the linked RCE vulnerability found by their friend https://kibty.town/blog/mintlify/ certainly would've been worth more than the $5,000 they were awarded. A vulnerability like that (or even a slightly worse XSS that allowed serving js instead of only svg) could've let them register service workers to all visiting users giving future XSS ability at any time, even…

Maybe? I don't know enough about the vulnerability. Is it serverside? Then it isn't worth very much.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#229

Post by llmslave2 »

rainonmoon wrote: post #70
hackermondev wrote: post #64

Earlier quoted context omitted.

imo, the impact is pretty clear here. an unsuspecting user clicks (or is redirected) to one of these malicious links on the platform (ex. vercel); the script grabs their cookie and credentials and sends it to the attacker. they now have full access to the victim's account.

Nice! So the Cookie is accessible by JavaScript on all of those sites? That would be pretty surprising given the prevalence of HttpOnly, so that doesn't seem clear to me at all. And they're all using Cookie-based auth, you think? You're a bug bounty hunter so I'll defer to your wisdom, but doesn't it seem more likely that an account takeover would be possible via a state-changing request from the user's existing sess…

XSS is a RCE exploit. It allows you to run any action as if you were the owner of the account. How is that not a full account takeover?

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#230

Post by tptacek »

rvnx wrote: post #223
0x3f wrote: post #222

Earlier quoted context omitted.

Because modern cookie directives and browser configs neuter a lot of the worst XSS outcomes/easiest exploit paths. I would expect all the big sites to be setting them, though I guess you never know.

I would not be that confident as you can see: on their first example, they show Discord and the XSS code is directly executed on Discord.com under the logged-in account (some people actually use web version of Discord to chat, or sign-in on the website for whatever reason). If you have a high-value target, it is a great opportunity to use such exploits, even for single shots (it would likely not be detected anyway si…

Again, here you have not so much sold a vulnerability as you have planned a heist. I agree, preemptively: you can get a lot of money from a well-executed heist!
Post reply on HN