Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cursor 0day: When Full Disclosure Becomes the Only Protection Left

mindgard.ai

Post reply on HN
Print view View original

21–30 of 222 posts

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#21

Post by Illniyar »

It's pretty weird for cursor to run arbitrary exe file without prompting, and alarming that the researchers did not get a proper response for months.

But the example with calculator is a bit misleading I think, you'll have to have a malicious exe already in the system and downloaded, and if cursor tried to run my understanding is that ACL should immediately kick in and you'll be asked for permission to run a new, unsigned app for the first time.

You'll have to have ACL disabled completely for this to be exploitable.

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#23

Post by Illniyar »

JMKH42 wrote: post #10
ajhenrydev wrote: post #8

This report reads a bit like AI writing :/ You need to have an already malicious payload on your pc to make this exploit work (via clone/download/magic). I can understand the severity of the exploit but at the same time I’d hope to not have to run into this situation for it to happen in the first place

wouldn't the attack vector be like this: I find a github repo, I want to contribute to it. I clone it, open up cursor, make an edit, commit, and boom, I am infected.

you would only need to open it to be exploited, not edit or prompt. Allegedly

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#24

Post by dakolli »

mike_hock wrote: post #18
nubg wrote: post #6

> Most coordinated disclosures follow a familiar pattern: > 1. A vulnerability is reported. > 2. A dialogue begins. > 3. Severity is discussed. > 4. Engineering teams investigate. > 5. Fixes are developed. > 6. Users are protected. > 7. Public disclosure follows. 8. The author prompts an LLM to write a blog post. 9. HN users are wasting time, unsure which parts of the post come from the actual prompt, and which are h…

Maybe the bug report got ignored because they posted another 1000 slop reports, who knows.

The disclosure seems pretty straight-forward, definitely some LLM assisted writing here, but not nearly as bad as most of the other stuff on this site.

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#25

Post by skeledrew »

mike_hock wrote: post #18
nubg wrote: post #6

> Most coordinated disclosures follow a familiar pattern: > 1. A vulnerability is reported. > 2. A dialogue begins. > 3. Severity is discussed. > 4. Engineering teams investigate. > 5. Fixes are developed. > 6. Users are protected. > 7. Public disclosure follows. 8. The author prompts an LLM to write a blog post. 9. HN users are wasting time, unsure which parts of the post come from the actual prompt, and which are h…

Maybe the bug report got ignored because they posted another 1000 slop reports, who knows.

Wonder who's fault it is when a critical security issue goes unresolved because "slop" report (sure ain't the reporters').

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#26

Post by skeledrew »

JMKH42 wrote: post #10
ajhenrydev wrote: post #8

This report reads a bit like AI writing :/ You need to have an already malicious payload on your pc to make this exploit work (via clone/download/magic). I can understand the severity of the exploit but at the same time I’d hope to not have to run into this situation for it to happen in the first place

wouldn't the attack vector be like this: I find a github repo, I want to contribute to it. I clone it, open up cursor, make an edit, commit, and boom, I am infected.

From my reading, boom happens at "open up cursor".

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#28

Post by firer »

All too common... It's sad yet understandable how a company would not prioritize security.

At the same time, it's also understandable how a security start-up, upon (rightly) getting fed up waiting, decide to publicly disclose, as a way to scrape some PR out of the sunk cost. Public disclosure has a place. But if you truly care about helping, you could do more than bumping on HackerOne and messaging the CISO once on LinkedIn.

Maybe I'm too cynical but it truly feels like nobody actually cares at this point.

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#29

Post by dalemhurley »

ajhenrydev wrote: post #8

This report reads a bit like AI writing :/ You need to have an already malicious payload on your pc to make this exploit work (via clone/download/magic). I can understand the severity of the exploit but at the same time I’d hope to not have to run into this situation for it to happen in the first place

If your an opensource developer you may get a pull request containing the the git.exe

Re: Cursor 0day: When Full Disclosure Becomes the Only Protection Left

#30

Post by dalemhurley »

Illniyar wrote: post #23
JMKH42 wrote: post #10

Earlier quoted context omitted.

wouldn't the attack vector be like this: I find a github repo, I want to contribute to it. I clone it, open up cursor, make an edit, commit, and boom, I am infected.

you would only need to open it to be exploited, not edit or prompt. Allegedly

From the article it occurs when Cursor is loaded. iDEs do a lot of stuff when they first open.
Post reply on HN