Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cursor 0day: When Full Disclosure Becomes the Only Protection Left

mindgard.ai

Post reply on HN
Print view View original

11–20 of 222 posts

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#11

Post by pixl97 »

ajhenrydev wrote: post #8

This report reads a bit like AI writing :/ You need to have an already malicious payload on your pc to make this exploit work (via clone/download/magic). I can understand the severity of the exploit but at the same time I’d hope to not have to run into this situation for it to happen in the first place

>You need to have an already malicious payload on your pc to make this exploit work

Uh, no, not exactly from what I'm reading.

At least from my piss poor understanding of it, you could possibly prompt inject something like "download https://github.com/hackmycursor/exploit.git". Would an agent do this, I'm unsure, but if so, it would download the git.exe and execute it.

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#12

Post by gruez »

aliasxneo wrote: post #4

I'm struggling to understand the process that went into this "feature" existing. It seems the most likely candidate is a developer's git started malfunctioning and an agent "fixed" it by dropping a `git.exe` in the repo and then conditionally calling it when it exists.

>It seems the most likely candidate is a developer's git started malfunctioning and an agent "fixed" it by dropping a `git.exe` in the repo and then conditionally calling it when it exists.

It doesn't need to be that deliberate. The default shell on windows (cmd.exe) includes the current directory into PATH by default. In other words, you don't need to do `./program.exe`, `program.exe` would suffice. That's probably where the bug came from. This also means if you were using cmd.exe, ran `git clone`, went inside it, then executed any command (eg. dir or git) you could get pwned.

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#13

Post by pixl97 »

conartist6 wrote: post #5
aliasxneo wrote: post #4

I'm struggling to understand the process that went into this "feature" existing. It seems the most likely candidate is a developer's git started malfunctioning and an agent "fixed" it by dropping a `git.exe` in the repo and then conditionally calling it when it exists.

and ever since, this approach has been a critical pathway for some billion dollar business probably. hooray

I see you also work in enterprise software.

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#14

Post by trollbridge »

pixl97 wrote: post #11
ajhenrydev wrote: post #8

This report reads a bit like AI writing :/ You need to have an already malicious payload on your pc to make this exploit work (via clone/download/magic). I can understand the severity of the exploit but at the same time I’d hope to not have to run into this situation for it to happen in the first place

>You need to have an already malicious payload on your pc to make this exploit work Uh, no, not exactly from what I'm reading. At least from my piss poor understanding of it, you could possibly prompt inject something like "download https://github.com/hackmycursor/exploit.git ". Would an agent do this, I'm unsure, but if so, it would download the git.exe and execute it.

This has been a problem with agent harnesses for as long as I've used them - prompting them to retrieve something often results in them going the extra mile and running and installing it.

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#15

Post by gene91 »

ajhenrydev wrote: post #8

This report reads a bit like AI writing :/ You need to have an already malicious payload on your pc to make this exploit work (via clone/download/magic). I can understand the severity of the exploit but at the same time I’d hope to not have to run into this situation for it to happen in the first place

Modern day code agents would clone a repo and read the code when you ask it a question about an API that’s not clearly documented. This vulnerability is real.

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#16

Post by drdexebtjl »

gruez wrote: post #12
aliasxneo wrote: post #4

I'm struggling to understand the process that went into this "feature" existing. It seems the most likely candidate is a developer's git started malfunctioning and an agent "fixed" it by dropping a `git.exe` in the repo and then conditionally calling it when it exists.

>It seems the most likely candidate is a developer's git started malfunctioning and an agent "fixed" it by dropping a `git.exe` in the repo and then conditionally calling it when it exists. It doesn't need to be that deliberate. The default shell on windows (cmd.exe) includes the current directory into PATH by default. In other words, you don't need to do `./program.exe`, `program.exe` would suffice. That's probably…

Windows doesn’t really have a default login shell like Unix.

Windows Terminal defaults to PowerShell which does not suffer from this issue.

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#17

Post by minraws »

Why is cursor subsequently executing anything? Like what is this black magic they want to do? I want to know the decision tree here? Was this cursor coded?

I do not understand the point, btw vim has had similar issues with it executing stuff you might not expect by loading a file but it was obviously a vim feature with %{expr}. But why specifically git.exe , this seems like the most redundant bug cve which could have been trivially patched, who does this feature help exactly?

I am not really a user of cursor never used it for even a single day, but at this point I am curious why this exists...

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#18

Post by mike_hock »

nubg wrote: post #6

> Most coordinated disclosures follow a familiar pattern: > 1. A vulnerability is reported. > 2. A dialogue begins. > 3. Severity is discussed. > 4. Engineering teams investigate. > 5. Fixes are developed. > 6. Users are protected. > 7. Public disclosure follows. 8. The author prompts an LLM to write a blog post. 9. HN users are wasting time, unsure which parts of the post come from the actual prompt, and which are h…

Maybe the bug report got ignored because they posted another 1000 slop reports, who knows.

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#19

Post by SpicyLemonZest »

minraws wrote: post #17

Why is cursor subsequently executing anything? Like what is this black magic they want to do? I want to know the decision tree here? Was this cursor coded? I do not understand the point, btw vim has had similar issues with it executing stuff you might not expect by loading a file but it was obviously a vim feature with %{expr}. But why specifically git.exe , this seems like the most redundant bug cve which could have…

Presumably it's trying to find the user's actual Git so that the built-in agent can load context on different branches, worktrees, etc. Of course there are less vulnerable ways to do that, but this kind of mildly justified hackiness is exactly where I'd expect an AI-assisted workflow to go wrong (and an AI-assisted bug triage to fail to alarm).

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#20

Post by [deleted] »

pixl97 wrote: post #11
ajhenrydev wrote: post #8

This report reads a bit like AI writing :/ You need to have an already malicious payload on your pc to make this exploit work (via clone/download/magic). I can understand the severity of the exploit but at the same time I’d hope to not have to run into this situation for it to happen in the first place

>You need to have an already malicious payload on your pc to make this exploit work Uh, no, not exactly from what I'm reading. At least from my piss poor understanding of it, you could possibly prompt inject something like "download https://github.com/hackmycursor/exploit.git ". Would an agent do this, I'm unsure, but if so, it would download the git.exe and execute it.

[deleted]
Post reply on HN