Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

gist.github.com

Post reply on HN
Print view View original

151–160 of 453 posts

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#151

Post by kenjackson »

Illniyar wrote: post #19

Nice discovery and writeup. Let alone for a 16 yo!. I've never heard an XSS vulnerability described as a supply-chain attack before though, usually that one is reserved for package managers malicious scripts or companies putting backdoors in hardware.

I think you can view it as supply chain as the supply chain is about attacking resources used to infiltrate downstream (or is it upstream? I get which direction I should think this flows).

As an end user you can't really mitigate this as the attack happens in the supply chain (Mintlify) and by the time it gets to you it is basically opaque. It's like getting a signed malicious binary. It looks good to you and the trust model (the browser's origin model) seems to indicate all is fine (like the signing on the binary). But because earlier in the supply chain they made a mistake, you are now at risk. Its basically moving an XSS up a level into the "supply chain".

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#152

Post by vablings »

tptacek wrote: post #93
0xbadcafebee wrote: post #53

Earlier quoted context omitted.

I can't imagine intelligence agencies/DoD not doing this with their gargantuan black budgets, if it's relevant to a specific target. They already contract with private research centers to develop exploits, and it's not like they're gonna run short on cash

If that were the case, we'd routinely see mysterious XSS exploits on social networks. The underlying bugs are almost always difficult to target! And yet we do not. The biggest problem, again, is that the vulnerabilities disappear instantaneously when the vendors learn about them; in fact, they disappear in epsilon time once the vulnerabilities are used , which is not how e.g. a mobile browser drive-by works.

Why would YOU see a mystery XSS exploit on a social network? The idea of the DoD scoring these little exploits in a box is usually to deploy in a highly controlled and specific manner. You as a layperson is of no interest to them unless you are some kind of intelligence asset or foreign adversary

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#153

Post by tptacek »

jijijijij wrote: post #150
tptacek wrote: post #143

Earlier quoted context omitted.

I do not in fact think you would make a lot more than $4000, or even $4000 in the first place, for an Apple XSS bug, unless it was extraordinarily situationally powerful (for instance, a first-stage for a clean, direct RCE). Bounty prices have nothing at all to do with the worst-case damage a motivated actor could cause with a vulnerability.

https://security.apple.com/bounty/categories/ The lowest tier is $5k. XSS up to $40k. I think we're talking exfiltration of dev credentials...

Nice, I hadn't seen that. Well, there you go: the absolute most you're going to make for the absolute worst-case XSS bug at the largest software firm in the world.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#154

Post by 0x0203 »

zffr wrote: post #122
Wowfunhappy wrote: post #118

Earlier quoted context omitted.

IMO, the bigger problem with SVGs as an image format is that different software often renders them (very) differently! It's a class of problem that raster image formats basically don't have.

I would have expected SVGs to be like PDFs and render the same across devices. Is the issue that some renderers don’t implement the full spec, or that some implement parts incorrectly?

Even PDFs don't always render the same from one platform to another. I've mostly seen it due to missing fonts.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#155

Post by ta1999 »

Not shocked given the following statement from Mintlify to a recruiter a few months ago:

"I'd rather hire a junior dev who knows the latest version of NextJS than a senior dev who is experienced with an earlier version."

This would be a forgivable remark, except the recruiter was aware of the shortsightedness, and likely attempted to coach the hiring manager...

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#156

Post by jonahx »

tptacek wrote: post #131
jonahx wrote: post #107

Earlier quoted context omitted.

> the actual market-clearing price of an XSS vulnerability is very low (in most cases, it doesn't exist at all) because there aren't existing business processes those vulnerabilities drop seamlessly into; they're all situational and time-sensitive. Could you elaborate on this? I don't fully understand the shorthand here.

I'm happy to answer questions but the only thing I could think to respond with here is just a restatement of what I said. I was terse; which part do you want me to expand on? Sorry about that!

> because there aren't existing business processes those vulnerabilities drop seamlessly into; they're all situational and time-sensitive.

what's an example of an existing business process that would make them valuable, just in theory? why do they not exist for xss vulns? why, and in what sense, are they only situational and time-sensitive?

i know you're an expert in this field. i'm not doubting the assertions just trying to understand them better. if i understand you're argument correctly, you're not doubting that the vuln found here could be damaging, only doubting that it could make money for an adversary willing to exploit it?

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#157

Post by Defletter »

Okay, seriously, can we just get one, just ONE document/image spec that doesn't let you embed scripts or remote content? What is with this constant need to put the same exactly vulnerability into EVERYTHING?! Just let me have a spec for completely static documents, jfc!

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#158

Post by james_marks »

finghin wrote: post #37
tuesdaynight wrote: post #8

Earlier quoted context omitted.

You are right, but that could (probably not) make them go for the bad route because they would get way more money that way. 4k for a bug that could take control of your customer account sounds disrespectful to me.

Yeah, my read is that the teenage hacker confronted with this ridiculous payslip sees two ways forward: accept the pay cut for the CV benefit of working with bug bounties, or get a bit better at hiding your ass and make them really pay.

If I were 16, I’d be thinking I just made an obscene amount of money ($4,000!) messing with computers for fun, and got to meet people at a famous company.

That’s a free car. Free computer. Uber eats for months.

And my status with my peers as a hacker would be cemented.

I get that bounty amounts are low vs SE salary, but that’s not at all how my 16yo self would see it.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#159

Post by Willish42 »

wonnage wrote: post #65
JackSlateur wrote: post #39

I struggle to understand the issue .. could someone help me out ? Ok, you got " https://discord.com/_mintlify/_static/hackerone-a00f3c6c/lma... " to send a controlled payload But regular users will never hit " https://discord.com/_mintlify/_static/hackerone-a00f3c6c/lma... ", so they will never execute your script I fail to understand how this can be exploited, by whom and in what conditions

You could send that link to an unsuspecting user and steal their cookies, make API requests to send messages on their behalf, etc Apparently one of the other linked posts shows how you can also gain RCE, since the docs are statically pre-rendered and there’s no sandboxing to prevent you from evalling arbitrary JavaScript.

> Apparently one of the other linked posts shows how you can also gain RCE

Yep, here it is: https://kibty.town/blog/mintlify/

Also linked in his guide (which I missed) and [here in a separate HN post](https://news.ycombinator.com/item?id=46317546). I think this other author's post is a lot more detailed and arguably more useful to folks reading on HN.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#160

Post by anthk »

actionfromafar wrote: post #106
hinkley wrote: post #49

Earlier quoted context omitted.

At least with external entities you could deny the parser an internet connection and force it to only load external documents from a cache you prepopulated and vetted. Turing completeness is a bullshit idea in document formats.

Postscript is pretty neat IMHO and it’s Turing complete. I really appreciated my raytraced page finally coming out of that poor HP laser after an hour or so.

PostScript can emulate the ZMachine (Zork text adventures and all of infocom) with "zmachine.ps". Look it up at DDG/GG.
Post reply on HN