Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

research.kudelskisecurity.com

Post reply on HN
Print view View original

111–120 of 244 posts

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#111

Post by woodruffw »

KingOfCoders wrote: post #30
curuinor wrote: post #25

hey, this is Howon from CodeRabbit here. we wish to note that this RCE was reported and fixed in January. it was entirely prospective and no customer data was affected. we have extensive sandboxing for basically any execution of anything now, including any and every tool and all generated code of any kind under the CodeRabbit umbrella. if you want to learn how CodeRabbit does the isolation, here's a blog post about h…

The chuzpe to use this as PR.

Off topic, but: chutzpah is the conventional English spelling :-)

Edit: I'm this old when I learned that Germans spell it "chuzpe."

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#112

Post by mihaaly »

sciencejerk wrote: post #35

I think that Security fuckups of this disastrous scale should get classified as "breaches" or "incidents" and be required to be publicly disclosed by the news media, in order to protect consumers. Here is a tool with 7,000+ customers and access to 1 million code repositories which was breached with an exploit a clever 11 year old could created. (edit: 1 million repos, not customers) When the exploit is so simple, I f…

Agreed.

Being a mere user of web or other apps developed using so clever and felxible and powerful services like this accidentally (due to sheer complexity) exposing all and everything I might consider dear makes me reconsider if I want to use any. When I am granted a real choice. Not so much as time progresses, not so much. Apps are there everywhere using other apps, mandated by organizations carrying out services outsourced by banks, governemnts, etc., granted third parties' access by me accepting T&C, probably catching trouble in the details, or probably not, cannot be sure.

A reassuring line like this >>This is not meant to shame any particular vendor; it happens to everyone<< may calm providers but scare the shit out of me as a user providing my sensitive data in exchange for something I need, or worst, must do.

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#113

Post by codedokode »

gpm wrote: post #110
codedokode wrote: post #96

One of the problems is that code analyzers, bundlers, compilers (like Rust compiler) allow running arbitrary code without any warning. Imagine following case: an attacker pretending to represent a company sends you a repository as a test task before the interview. You run something like "npm install" or run Rust compiler, and your computer is controlled by an attacker now. Or imagine how one coworker's machine gets h…

> compilers (like Rust compiler) allow running arbitrary code without any warning. It's safe to assume that the Rust compiler (like any compiler built on top of LLVM) has arbitrary code execution vulnerabilities, but as an intended feature I think this only exists in cargo, the popular/official build system, not rustc, the compiler.

Rust has "procedural macros" which means executing arbitrary code during compilation: https://doc.rust-lang.org/reference/procedural-macros.html

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#114

Post by curuinor »

vadepaysa wrote: post #92

I cancelled my coderabbit paid subscription, because it always worries me when a post has to go viral on HN for a company to even acknowledge an issue occurred. Their blogs are clean of any mention of this vulnerability and they don't have any new posts today either. I understand mistakes happen, but lack of transparency when these happen makes them look bad.

https://www.coderabbit.ai/blog/our-response-to-the-january-2...

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#115

Post by gpm »

codedokode wrote: post #113
gpm wrote: post #110

Earlier quoted context omitted.

> compilers (like Rust compiler) allow running arbitrary code without any warning. It's safe to assume that the Rust compiler (like any compiler built on top of LLVM) has arbitrary code execution vulnerabilities, but as an intended feature I think this only exists in cargo, the popular/official build system, not rustc, the compiler.

Rust has "procedural macros" which means executing arbitrary code during compilation: https://doc.rust-lang.org/reference/procedural-macros.html

Eh, rust has procedural macros, which means executing pre-built plugins during compilation. You can't execute arbitrary code, because you can't make and then execute new macros, you can only run the macros made available to you via the filesystem.

Admittedly that's a bit like saying "a simple shell isn't arbitrary code execution"... except there tend to be binaries lying around on the filesystem which do things, unlike procedural macros.

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#116

Post by Philpax »

codedokode wrote: post #113
gpm wrote: post #110

Earlier quoted context omitted.

> compilers (like Rust compiler) allow running arbitrary code without any warning. It's safe to assume that the Rust compiler (like any compiler built on top of LLVM) has arbitrary code execution vulnerabilities, but as an intended feature I think this only exists in cargo, the popular/official build system, not rustc, the compiler.

Rust has "procedural macros" which means executing arbitrary code during compilation: https://doc.rust-lang.org/reference/procedural-macros.html

It can invoke procedural macros, but those macros need to be built by something, and rustc won't do that by itself: https://blog.jetbrains.com/rust/2022/07/07/procedural-macros...

I still think it's very not good that proc macros have full access to your system, but `rustc` alone cannot build a hostile macro as part of building some code that depends upon it.

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#117

Post by shakna »

gpm wrote: post #110
codedokode wrote: post #96

One of the problems is that code analyzers, bundlers, compilers (like Rust compiler) allow running arbitrary code without any warning. Imagine following case: an attacker pretending to represent a company sends you a repository as a test task before the interview. You run something like "npm install" or run Rust compiler, and your computer is controlled by an attacker now. Or imagine how one coworker's machine gets h…

> compilers (like Rust compiler) allow running arbitrary code without any warning. It's safe to assume that the Rust compiler (like any compiler built on top of LLVM) has arbitrary code execution vulnerabilities, but as an intended feature I think this only exists in cargo, the popular/official build system, not rustc, the compiler.

Any language that supports constexpr, like Rust's const fn [0], can execute arbitrary code at compile time.

[0] https://github.com/rust-lang/rust/issues/57563

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#118

Post by Philpax »

criemen wrote: post #102
codedokode wrote: post #96

One of the problems is that code analyzers, bundlers, compilers (like Rust compiler) allow running arbitrary code without any warning. Imagine following case: an attacker pretending to represent a company sends you a repository as a test task before the interview. You run something like "npm install" or run Rust compiler, and your computer is controlled by an attacker now. Or imagine how one coworker's machine gets h…

> Maybe those tools should explicitly confirm executing every external command This wouldn't work - it's not external commands that's the problem, it's arbitrary code that's being executed. That code has access to all regular system APIs/syscalls, so there's no way of explicitly confirming external commands. Python/pip suffers the same problem btw, so I think that ship has sailed.

Rust is investigating using sandboxed WASM for proc macros, but it'll be some time before there's any movement there: https://github.com/rust-lang/compiler-team/issues/876

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#119

Post by jeremyjh »

codedokode wrote: post #96

One of the problems is that code analyzers, bundlers, compilers (like Rust compiler) allow running arbitrary code without any warning. Imagine following case: an attacker pretending to represent a company sends you a repository as a test task before the interview. You run something like "npm install" or run Rust compiler, and your computer is controlled by an attacker now. Or imagine how one coworker's machine gets h…

> Whoever wrote "12 points app" doesn't know that there are command-line switches and configuration files for this.

That would mean all those values are in the clear in the process table. You couldn’t do a “ps” without exposing them.

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#120

Post by acaloiar »

curuinor wrote: post #114
vadepaysa wrote: post #92

I cancelled my coderabbit paid subscription, because it always worries me when a post has to go viral on HN for a company to even acknowledge an issue occurred. Their blogs are clean of any mention of this vulnerability and they don't have any new posts today either. I understand mistakes happen, but lack of transparency when these happen makes them look bad.

https://www.coderabbit.ai/blog/our-response-to-the-january-2...

For anyone following along in the comments here. Code Rabbit's CEO posted some of the details today, after this post hit HN.

The usual "we take full responsibility" platitudes.

Post reply on HN