Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

gist.github.com

Post reply on HN
Print view View original

251–260 of 453 posts

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#251

Post by rvnx »

MajesticHobo2 wrote: post #192
vablings wrote: post #152

Earlier quoted context omitted.

Why would YOU see a mystery XSS exploit on a social network? The idea of the DoD scoring these little exploits in a box is usually to deploy in a highly controlled and specific manner. You as a layperson is of no interest to them unless you are some kind of intelligence asset or foreign adversary

Wouldn't platforms see the supposed XSS payloads in their logs and publish analyses of them, or at the very least, announce that they happened?

Seems like none of these major websites detected anything, and they are supposed to be top-notch in the world.

It's only because the researcher contacted them.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#252

Post by rvnx »

rainonmoon wrote: post #235
llmslave2 wrote: post #229

Earlier quoted context omitted.

XSS is a RCE exploit. It allows you to run any action as if you were the owner of the account. How is that not a full account takeover?

XSS is categorically not an RCE and my point is that mitigations exist which make "It allows you to run any action as if you were the owner of the account" an unwarranted assumption. The writeup shows that it's possible to pop an alert box. That doesn't tell you anything about what's actually possible. Obviously Discord got enough information to take it seriously, but extrapolating that to suggest every third-party u…

Well, llmslave2 is right. If discord.com executes javascript to conduct user actions, and you can execute javascript on discord.com, you are acting on the account as if you were discord.com

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#253

Post by rvnx »

bangaladore wrote: post #77
jeffjeffbear wrote: post #61

Earlier quoted context omitted.

You have control over what displays on a page with a discord.com domain, you could manipulate the dom to have a login or something else and have it pass the data to your servers. A user would just see a link from discord.com

Yeah, this one must be socially engineered-- but a (fake) login page when accessing a docs site would fool most people. Thankfully the browser prevents sending the cookies cross origin or else this is just a single click exploit. Edit: I gave too much credit to Discord here. They aren't protecting their tokens correctly.

You can also just be logged-in on Discord web, so everything is accessible too

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#254

Post by Blackthorn »

zffr wrote: post #122
Wowfunhappy wrote: post #118

Earlier quoted context omitted.

IMO, the bigger problem with SVGs as an image format is that different software often renders them (very) differently! It's a class of problem that raster image formats basically don't have.

I would have expected SVGs to be like PDFs and render the same across devices. Is the issue that some renderers don’t implement the full spec, or that some implement parts incorrectly?

Most renderers don't implement the full spec.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#255

Post by notnullorvoid »

rvnx wrote: post #243
notnullorvoid wrote: post #237

Earlier quoted context omitted.

`history.replaceState(null, "", "/login")`

For Coinbase docs, this is a disaster particularly

By they looks of it their docs are under a subdomain, and no part of the domain can be changed when setting the url this way. So it would still look a little out of place at least.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#256

Post by tptacek »

rvnx wrote: post #251
MajesticHobo2 wrote: post #192

Earlier quoted context omitted.

Wouldn't platforms see the supposed XSS payloads in their logs and publish analyses of them, or at the very least, announce that they happened?

Seems like none of these major websites detected anything, and they are supposed to be top-notch in the world. It's only because the researcher contacted them.

Also because nobody actively exploited them! You're using the word "detected" to mean "discovered", which nobody working in the field would ever do.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#257

Post by notnullorvoid »

drewvlaz wrote: post #204
notnullorvoid wrote: post #196

Earlier quoted context omitted.

In general if a script can run, users sessions and more importantly passwords are at risk. It's true that an HTTP-only session cookie couldn't be directly taken, but it's trivial to present the user with a login screen and collect their password (and OTP), at which point you can easily get a session remotely. It can look entirely like the regular login page right down to the url path (because the script can modify th…

Wow did not realize a url could be set like that without promoting a page reload...

To be clear only the path and query parameters part of the url can change, the domain (or sub domain) stays intact.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#258

Post by llmslave2 »

rainonmoon wrote: post #235
llmslave2 wrote: post #229

Earlier quoted context omitted.

XSS is a RCE exploit. It allows you to run any action as if you were the owner of the account. How is that not a full account takeover?

XSS is categorically not an RCE and my point is that mitigations exist which make "It allows you to run any action as if you were the owner of the account" an unwarranted assumption. The writeup shows that it's possible to pop an alert box. That doesn't tell you anything about what's actually possible. Obviously Discord got enough information to take it seriously, but extrapolating that to suggest every third-party u…

How is XSS not remote code execution? You can do anything, from send fetch requests to the server with full credentials to loggging keystrokes or even open a tunnel and eval payloads...

Anything the user can do, you can do via an XSS attack.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#260

Post by rainonmoon »

rvnx wrote: post #252
rainonmoon wrote: post #235

Earlier quoted context omitted.

XSS is categorically not an RCE and my point is that mitigations exist which make "It allows you to run any action as if you were the owner of the account" an unwarranted assumption. The writeup shows that it's possible to pop an alert box. That doesn't tell you anything about what's actually possible. Obviously Discord got enough information to take it seriously, but extrapolating that to suggest every third-party u…

Well, llmslave2 is right. If discord.com executes javascript to conduct user actions, and you can execute javascript on discord.com, you are acting on the account as if you were discord.com

Except discord.com doesn't execute JavaScript, the user's browser does. These are meaningful distinctions that delineate the impact. You aren't "discord.com" if you target someone with an XSS exploit, you've only run a script in a user's session. Whether you can actually do anything with that script or not decides whether you can take over the account or not.
Post reply on HN