Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

research.kudelskisecurity.com

Post reply on HN
Print view View original

161–170 of 244 posts

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#161

Post by bigiain »

sophacles wrote: post #148
robomc wrote: post #130

From the CEO's response: > On January 24, 2025, security researchers from Kudelski Security disclosed a vulnerability to us through our Vulnerability Disclosure Program (VDP). The researchers identified that Rubocop, one of our tools, was running outside our secure sandbox environment—a configuration that deviated from our standard security protocols. Honestly, that last part sounds like a lie. Why would one task run…

> Why would one task run in a drastically different architectural situation Someone made a mistake. These things happen. > and it happen to be the one exploited? Why would the vulnerable service be the service that is exploited? It seems to me that's a far more likely scenario than the non-vulnerable service being exploited... no?

> > Why would one task run in a drastically different architectural situation

> Someone made a mistake. These things happen.

Some company didn't have appropriate processes in place.

For ISO27001 certification you at least need to pay lip service to having documents and policies about how you deploy secure platforms. (As annoying as ISO certification is, it does at least try to ensure you have thought about andedocumented stuff like this.)

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#162

Post by viraptor »

wredcoll wrote: post #132
viraptor wrote: post #126

Earlier quoted context omitted.

Most security bugs get fixed without any public notice. Unless there was any breach of customer information (and that can be often verified), there are typically no legal requirements. And there's no real benefit to doing it either. Why would you expect it to happen?

The benefit, apparently, is that people like this guy don't cancel their memberships.

And how many would cancel is they published every security issue they fixed?

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#163

Post by ofjcihen »

wredcoll wrote: post #136
moomoo11 wrote: post #94

Earlier quoted context omitted.

I got so much heat for calling out that Tea app for being imbeciles who couldn’t bother finishing reading the firebase docs. People were quick to blame firebase instead of the devs. Vibrators are so fucking annoying, mostly dumb, and super lame.

This post would have a lot more meaning if "vibe coders" were the only ones making security mistakes that involved thousands of customers.

The post still has meaning.

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#164

Post by wheelerwj »

jdlshore wrote: post #139
robomc wrote: post #130

From the CEO's response: > On January 24, 2025, security researchers from Kudelski Security disclosed a vulnerability to us through our Vulnerability Disclosure Program (VDP). The researchers identified that Rubocop, one of our tools, was running outside our secure sandbox environment—a configuration that deviated from our standard security protocols. Honestly, that last part sounds like a lie. Why would one task run…

Not sure why it seems like a lie. Oversights like this happen all the time.

100%. Sounds like a very common oversight at many companies.

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#165

Post by moomoo11 »

wredcoll wrote: post #136
moomoo11 wrote: post #94

Earlier quoted context omitted.

I got so much heat for calling out that Tea app for being imbeciles who couldn’t bother finishing reading the firebase docs. People were quick to blame firebase instead of the devs. Vibrators are so fucking annoying, mostly dumb, and super lame.

This post would have a lot more meaning if "vibe coders" were the only ones making security mistakes that involved thousands of customers.

Yeah you're right. Your post would have a lot more meaning if you would realize that the rate at which security mistakes are occurring is about to explode (if not already).

That's like saying if/when an AV runs over a bunch of people that its not like they're the only ones running over people human drivers do it too!

Thankfully, Waymo which I use regularly is fkin awesome and actually works. Then again, they're not vibrating.

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#167

Post by Jap2-0 »

curuinor wrote: post #114
vadepaysa wrote: post #92

I cancelled my coderabbit paid subscription, because it always worries me when a post has to go viral on HN for a company to even acknowledge an issue occurred. Their blogs are clean of any mention of this vulnerability and they don't have any new posts today either. I understand mistakes happen, but lack of transparency when these happen makes them look bad.

https://www.coderabbit.ai/blog/our-response-to-the-january-2...

Hmm, is it normal practice to rotate secrets before fixing the vulnerability?

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#168

Post by viraptor »

singleshot_ wrote: post #156
viraptor wrote: post #126

Earlier quoted context omitted.

Most security bugs get fixed without any public notice. Unless there was any breach of customer information (and that can be often verified), there are typically no legal requirements. And there's no real benefit to doing it either. Why would you expect it to happen?

> Unless there was any breach of customer information (and that can be often verified), there are typically no legal requirements. If the company is regulated by the SEC I believe you will find that any “material” breach is reportable after the determination of materiality is reached, since at least 2023.

Sure. And these types of "we fixed it and confirmed nobody actually exploited it" issues are not always treated as material. You can confirm that for example by checking SEC reports for each cve in commercial VPN gateways... or lack of.

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#169

Post by jeremyjh »

raggi wrote: post #144
codedokode wrote: post #96

One of the problems is that code analyzers, bundlers, compilers (like Rust compiler) allow running arbitrary code without any warning. Imagine following case: an attacker pretending to represent a company sends you a repository as a test task before the interview. You run something like "npm install" or run Rust compiler, and your computer is controlled by an attacker now. Or imagine how one coworker's machine gets h…

I love this implication that there's some valuable body of code out there that gets reviewed, compiled and never executed.

They are talking about executing code at compile time (macros and such). With modern IDEs/editors, just opening the folder may trigger such behavior (when LSP boots and compiles) though some environments warn you.

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#170

Post by teaearlgraycold »

mkeeter wrote: post #129
curuinor wrote: post #114

Earlier quoted context omitted.

https://www.coderabbit.ai/blog/our-response-to-the-january-2...

The LLM tics are strong in this writeup: "No manual overrides, no exceptions." "Our VDP isn't just a bug bounty—it's a security partnership"

Absolutely. In my experience every AI startup is full of AI maximalists. They use AI for everything they can - in part because they believe in the hype, in part to keep up to date with model capabilities. They would absolutely go so far as to write such an important piece of text using an LLM.
Post reply on HN