Content Injection Attack on GitHub
github.com
Content Injection Attack on GitHub
1–10 of 52 posts
Re: Content Injection Attack on GitHub
#2Well done
Re: Content Injection Attack on GitHub
#3Explanation for this with a better link: https://news.ycombinator.com/item?id=40615804
Re: Content Injection Attack on GitHub
#4Source-code: https://raw.githubusercontent.com/younesbram/younesbram/main...
(Injection in LaTeX math tags)
Re: Content Injection Attack on GitHub
#5So this opened in my GitHub iOS app at first and I was confused.
Re: Content Injection Attack on GitHub
#6You can see in the commit log from on https://github.com/younesbram/younesbram/commit/4282312e4ec3... where the first PoC commit is pushed up.
The thing I find interesting is that this wasn't a random discovered; like, you look at the first commit in the sequence and you'll see.
> \ce{$\unicode[goombafont; color:red; pointer-events: none; ...
ie. This isn't some random chance discovery.
This is someone looking to use a specific exploit with the ```math tag, already certain that there's some way of doing it.
How strange.
Re: Content Injection Attack on GitHub
#7Funny at first, but this could have been exploited maliciously by let's displaying a message telling the user he has been disconnected and redirecting him to a phishing page.
Re: Content Injection Attack on GitHub
#8You can see in the commit log from on https://github.com/younesbram/younesbram/commit/4282312e4ec3... where the first PoC commit is pushed up. The thing I find interesting is that this wasn't a random discovered; like, you look at the first commit in the sequence and you'll see. > \ce{$\unicode[goombafont; color:red; pointer-events: none; ... ie. This isn't some random chance discovery. This is someone looking to use…
This isn't the source of it. I came across this on Twitter last night and traced it back a bit to try to share "the original" with my colleagues. The earliest I found was https://x.com/cloud11665/status/1799136093071163396 which I think is slightly earlier than the second commit on this repo.
Re: Content Injection Attack on GitHub
#9You can see in the commit log from on https://github.com/younesbram/younesbram/commit/4282312e4ec3... where the first PoC commit is pushed up. The thing I find interesting is that this wasn't a random discovered; like, you look at the first commit in the sequence and you'll see. > \ce{$\unicode[goombafont; color:red; pointer-events: none; ... ie. This isn't some random chance discovery. This is someone looking to use…
that was the first iteration of CSS injection that was working, that github then patched. The new one is the new iteration that still works
it was found by a bunch of anime-pfps on twitter and went "viral"
Re: Content Injection Attack on GitHub
#10Does this still work? Opened in Safari and don’t see anything out of place