Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

gist.github.com

Post reply on HN
Print view View original

341–350 of 453 posts

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#341

Post by mattmanser »

tptacek wrote: post #41
llmslave2 wrote: post #22

This feels so emblematic of our current era. VC funded vibe coded AI documentation startup somehow gets big name customers who don't properly vet the security of the platform, ship a massive vulnerability that could pwn millions of users and the person who reports the vulnerability gets...$5k. If I recall last week Mintlify wrote a blog post showcasing their impressive(ly complicated) caching architecture. Pretending…

I don't think anybody in SFBA-style software development, both pre- and post-LLM, is really resilient against these kinds of attacks. The problem isn't vibe coding so much as it is multiparty DLL-hell dependency stacks, which is something I attribute more to Javascript culture than to any recent advance in technology.

It's got nothing to do with DLLs or libraries or anything like that. This is a bug in their domain code. This is a simple, and bloody stupid, multi-tenant bug in a SaaS where they're not checking the tenant id before serving tenant content. Coupled with exploiting same domain cookies. Both of these have been problems that we have dealt with, and been vigilant against in SaaS apps. We had a lot of these type of attacks in the 00s when people first started deploying SaaSes and for a while we were all vigilant. The common vector for cookies back then was you'd have your main app "acmeforce.com" and you'd host customers under sub-domains like "arasaka.acmeforce.com" and cookie shenanigans would allow all sorts of attack vectors against the root site (I think github had one at one point, might be wrong!).

It's more that browser changes have allowed us to forget cookie problems, in a good way. And software developers seem to have a memory of a goldfish. The browsers have tried to build in all sort of protections against these attacks, but they only work against different domains, so we hit all the same problems as soon as some inexperienced developers starts making a multi-tenant app without proper testing.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#342

Post by VBprogrammer »

Wowfunhappy wrote: post #118
dllu wrote: post #5

The fact that SVG files can contain scripts was a bit of a mistake. On one hand, the animations and entire interactive demos and even games in a single SVG are cool. But on the other hand, it opens up a serious can of worms of security vulnerabilities. As a result, SVG files are often banned from various image upload tools, they do not unfurl previews, and so on. If you upload an SVG to discord, it just shows the raw…

IMO, the bigger problem with SVGs as an image format is that different software often renders them (very) differently! It's a class of problem that raster image formats basically don't have.

Yeah, I spent a bit of time trying to figure out some masking issues with a file I created in Inkscape but which chrome would butcher. Turned out to be opacity on a mask layer or something.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#343

Post by zwnow »

mpeg wrote: post #183
zwnow wrote: post #83

Earlier quoted context omitted.

While I would love that for the kid I dont think these companies care about security at all.

I think that's unfair to say about a company that pays bug bounties at all. A lot of other companies would have ignored the email for weeks or threatened legal action.

Its cheaper to pay bug bounties than to hire a security expert or legal costs

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#344

Post by philipwhiuk »

0xbadcafebee wrote: post #40

How these companies don't hire kids like Daniel for pennies on the dollar and have him attack their stacks on a loop baffles me. Pay the kid $50k/yr (part time, he still needs to go to school) to constantly probe your crappy stacks. Within a year or two you'll have the most goddamn secure company on the internet - and no public vulns to embarrass you.

I doubt it.

Just because he found one vulnerability at one vendor used by Discord doesn't mean he'll find all the vulnerabilities that exist at Discord or indeed any of them.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#345

Post by compootr »

panzi wrote: post #268
superasn wrote: post #128

This is a pretty scary exploit, considering how easily it could be abused. Imagine just one link in a tweet, support ticket, or email: https://discord.com/_mintlify/static/evil/exploit.svg . If you click it, JavaScript runs on the discord.com origin. Here's what could happen: - Your Discord session cookies and token could be stolen, leading to a complete account takeover. - read/write your developer applications & we…

> - Your Discord session cookies and token could be stolen, leading to a complete account takeover. Discord uses HttpOnly cookies (except for the cookie consent banner).

tokens are stored in localStorage, which is accessible by JS

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#346

Post by promiseofbeans »

rvnx wrote: post #223
0x3f wrote: post #222

Earlier quoted context omitted.

Because modern cookie directives and browser configs neuter a lot of the worst XSS outcomes/easiest exploit paths. I would expect all the big sites to be setting them, though I guess you never know.

I would not be that confident as you can see: on their first example, they show Discord and the XSS code is directly executed on Discord.com under the logged-in account (some people actually use web version of Discord to chat, or sign-in on the website for whatever reason). If you have a high-value target, it is a great opportunity to use such exploits, even for single shots (it would likely not be detected anyway si…

> some people actually use web version of Discord to chat, or sign-in on the website for whatever reason

Beside this security blunder on Discord’s part, I can see only upsides to using a browser version rather than an Electron desktop app. Especially given how prone Discord are to data mining their users, it seems foolish to let them out of the web sandbox and into your system

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#347

Post by promiseofbeans »

isodev wrote: post #326

Btw, apart from Discord, you really should stop using the other ones (X, Vercel, Cursor...). Do yourself and the planet a favour :)

Stop using Discord as well - their software is packed full of data mining, ads, and cosmetic upsells. For public community groups use a forum site (then it’s indexable as well!), and for private groups use something actually private like Signal

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#348

Post by promiseofbeans »

hunvreus wrote: post #249
multisport wrote: post #55

decided to make a new account to post: Mintlify security is the worse I have even encountered in a modern SaaS company. They will leak your data, code, assets, etc. They will know they did this. You will tell them, they will acknowledge that they knew it happened, and didn't tell you. Your docs site will go down, and you will need to page their engineers to tell them its down. This will be a surprise to them.

Absolute self-promotion: https://github.com/hunvreus/reallysimpledocs

Astro’s starlight docs generator/template is quite nice as well: https://starlight.astro.build/

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#350

Post by sdf456 »

notnullorvoid wrote: post #257
drewvlaz wrote: post #204

Earlier quoted context omitted.

Wow did not realize a url could be set like that without promoting a page reload...

To be clear only the path and query parameters part of the url can change, the domain (or sub domain) stays intact.

Even scarier to me than the vulnerability is that Fidelity (whom I personally think is a good bank and investment company) was using a third party that allowed injection that could potentially steal a whole lot of money, affect markets, ruin or terminate billions of lives, and affect the course of humanity. What the fuck.
Post reply on HN