wow it felt like they were playing around lol
How to hack Discord, Vercel and more with one easy trick
31–39 of 39 posts
Re: How to hack Discord, Vercel and more with one easy trick
#32This feels so emblematic of our current era. VC funded vibe coded AI documentation startup somehow gets big name customers who don't properly vet the security of the platform, ship a massive vulnerability that could pwn millions of users and the person who reports the vulnerability gets...$5k. If I recall last week Mintlify wrote a blog post showcasing their impressive(ly complicated) caching architecture. Pretending…
Chill - just because someone got hacked doesn't mean their product is trash. Easily every mass adopted product created prior to 2023 has been hacked at some point.
> Chill - just because someone got hacked doesn't mean their product is trash
Yes, but the vulnerabilities reported in this collection of articles really smell like trash. Allowing untrusted code from your customers to be executed in a shared environment with no isolation is like, extremely amateurish.
Re: How to hack Discord, Vercel and more with one easy trick
#33Earlier quoted context omitted.
I'm giving them the benefit of the doubt, as the alternative would be that their developers are completely incompetent. The vulnerability is the equivalent to letting a user save HTML to a database and then injecting it into every page completely unsanitized.
Mintlify had a blacklist in place to not allow them to do this with most file types. Someone failed to add SVG to it. It's not like they weren't thinking about security. The challenge with security, as you know, is it's only as strong as it's weakest link. It only takes one ignorant/incompetent person in an entire organization to jeopordize the org. But even a competent person can make a crucial mistake.
> It's not like they weren't thinking about security
https://kibty.town/blog/mintlify/
The first CVE here definitely sounds like they absolutely weren't thinking care security.
Re: How to hack Discord, Vercel and more with one easy trick
#34How is a company like mintlify getting so many big name customers for what appears to be a static site generator + hosting? Is there some secret sauce I'm missing, what is the value proposition?
I genuinely don't know, especially for Vercel to be using them. Vercel themselves can easily be used to host static-ish documentation.
But it looks like Mintlify are using Vercel on the backend: https://vercel.com/blog/mintlify-scaling-a-powerful-document...
So it's just a Vercel wrapper?
Re: How to hack Discord, Vercel and more with one easy trick
#35isn't this actually XSRF and worse than XSS? Also, if users can run arbitrary JS on someone else's server then what stops them from doing CPU-bound work such as crypto miners?
SSRF* sorry typo
Re: How to hack Discord, Vercel and more with one easy trick
#36Earlier quoted context omitted.
It's actually pretty on-par for most bug bounties. They used the same exploit on a few programs and got $11k total which ain't bad return on time.
No I know it's on par I guess better rephrasing would be the par is still too low
Compared to what? What's your baseline for how much a user-interaction-required XSS vulnerability should be worth?
Re: How to hack Discord, Vercel and more with one easy trick
#37Earlier quoted context omitted.
No I know it's on par I guess better rephrasing would be the par is still too low
Compared to what? What's your baseline for how much a user-interaction-required XSS vulnerability should be worth?
I'm not basing it on math.
Are you saying tho that 2.5k wouldhave been adequate in 2019? I expect 5k would have been on par then too. But idk
Re: How to hack Discord, Vercel and more with one easy trick
#38This feels so emblematic of our current era. VC funded vibe coded AI documentation startup somehow gets big name customers who don't properly vet the security of the platform, ship a massive vulnerability that could pwn millions of users and the person who reports the vulnerability gets...$5k. If I recall last week Mintlify wrote a blog post showcasing their impressive(ly complicated) caching architecture. Pretending…
Why did you post the same comment twice? This is not Reddit, my friend.
Re: How to hack Discord, Vercel and more with one easy trick
#39Wow this is interesting, however, the reward seems way too less to me.