Explanation for this with a better link: https://news.ycombinator.com/item?id=40615804
ok that lego thing is far out... not that great but I guess it helps people understand - lol
Content Injection Attack on GitHub
21–30 of 52 posts
Re: Content Injection Attack on GitHub
#22You can see in the commit log from on https://github.com/younesbram/younesbram/commit/4282312e4ec3... where the first PoC commit is pushed up. The thing I find interesting is that this wasn't a random discovered; like, you look at the first commit in the sequence and you'll see. > \ce{$\unicode[goombafont; color:red; pointer-events: none; ... ie. This isn't some random chance discovery. This is someone looking to use…
I don't think you can really trust commit history to deduce this:
- the history can be rewritten, with push --force. The author might have iterated by force pushing one commit
- The author could have discovered it by change in a private repository, or another repository that they deleted
Re: Content Injection Attack on GitHub
#23Looks like this has been patched
Re: Content Injection Attack on GitHub
#24Re: Content Injection Attack on GitHub
#25Other than I love Samy, are many real-world examples of XSS being exploited for massive takeover of some service? I can't say I remember any news of a "website/service totally taken over due to XSS."
It’s pretty infrequent outside of target attacks. Most recent is probably the roundcube XSS CVE-2023-43770 that was actively exploited as 0day by a threat actor last year.
Re: Content Injection Attack on GitHub
#26I don't get this. It shows some mangled text that looks like defaced CSS, accompanied by the error message “Extra open brace or missing close brace”. How is this content injection? But the rescue murloc is cute.
GitHub just fixed the issue right now, the markdown you can see was injecting new background to the page, floating GIFs everywhere, etc.
Re: Content Injection Attack on GitHub
#27GH just fixed it, but there's a snapshot from few hours ago: https://web.archive.org/web/20240608060046/https://github.co...
Re: Content Injection Attack on GitHub
#28Earlier quoted context omitted.
that was the first iteration of CSS injection that was working, that github then patched. The new one is the new iteration that still works it was found by a bunch of anime-pfps on twitter and went "viral"
What does one's pfp matter, if what they found holds water?
In this case it adds to their credentials
Re: Content Injection Attack on GitHub
#29Explanation for this with a better link: https://news.ycombinator.com/item?id=40615804
That goes right onto my 'convoluted explanations that make things more complicated than they really are' stack.
Re: Content Injection Attack on GitHub
#30Explanation for this with a better link: https://news.ycombinator.com/item?id=40615804
ok that lego thing is far out... not that great but I guess it helps people understand - lol
It did not help me. A Lego castle with … a secret magical tunnel? Just explain things, no need to besmirch Lego in this case.