Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Supply Chain Vuln Compromised Core AWS GitHub Repos & Threatened the AWS Console

wiz.io

Post reply on HN
Print view View original

21–30 of 40 posts

Re: Supply Chain Vuln Compromised Core AWS GitHub Repos & Threatened the AWS Console

#21

Post by acdha »

whatever1 wrote: post #20
pxc wrote: post #11

Earlier quoted context omitted.

I met regexes when I was 13, I think. I spent a little time reading the Java API docs on the language's regex implementation and played with a couple of regex testing websites during an introductory programming class at that age. I've used them for the rest of my life without any difficulty. Strict (formal) regexes are extremely simple, and even when using crazy implementations that allow all kinds of backreferences…

[flagged]

This is too hot a take. Regular expressions are used in some cases where they shouldn’t be, yes, but there’s also been a ton of code which used other string operations but had bugs due to the complexity or edge-cases which would have been easier to avoid with a regex. You should know both tools and when they’re appropriate.

Re: Supply Chain Vuln Compromised Core AWS GitHub Repos & Threatened the AWS Console

#22

Post by whatever1 »

acdha wrote: post #21
whatever1 wrote: post #20

Earlier quoted context omitted.

[flagged]

This is too hot a take. Regular expressions are used in some cases where they shouldn’t be, yes, but there’s also been a ton of code which used other string operations but had bugs due to the complexity or edge-cases which would have been easier to avoid with a regex. You should know both tools and when they’re appropriate.

Regex is not used for parsing HTML or C++ code. So it is not good for complex tasks.

What is the claim? That it is compact for simple cases. Well Brainfuck is a compact programming language but I don't see it in production. Why?

Because the whole point of programming is that multiple eyeballs of different competence are looking at the same code. It has to be as legible as possible.

Re: Supply Chain Vuln Compromised Core AWS GitHub Repos & Threatened the AWS Console

#23

Post by jacquesm »

I try to avoid regexes like the plague, it is right up there with passing stuff into SQL strings. It is tempting enough to be used but it always goes wrong, no matter how good your sanitation. Even if the original author gets it right sooner or later someone will tweak the regex just a little to allow some edgecase and accidentally open the door to a whole pile of other cases. It's just too finicky and too powerful.

Re: Supply Chain Vuln Compromised Core AWS GitHub Repos & Threatened the AWS Console

#24

Post by az226 »

btown wrote: post #12

> To escalate privileges, we abused the token’s repo scope, which can manage repository collaborators, and invited our own GitHub user to be a repository administrator. From everything I know about pentesting, they should have stopped before doing this, right? From https://hackerone.com/aws_vdp?type=team : > You may only interact with accounts you own or with explicit written permission from AWS or the account owner

It’s possible that AWS is a Wiz customer, which would allow them to do more stuff.

Re: Supply Chain Vuln Compromised Core AWS GitHub Repos & Threatened the AWS Console

#25

Post by SkiFire13 »

bink wrote: post #14
chuckadams wrote: post #2

Breaking this down, several of AWS's core repos like the JS SDK use an allowlist of which contributor ids can run workflow actions in their PRs. The list was a regex, contained several short ids, and wasn't anchored with ^$, so if it allowed user 12345, then any userid containing 12345 could run their own actions on the PR, including one that exfiltrated access tokens. So they spammed GH with user creation requests,…

As a security dude I spend way too much of my time fixing missing anchors or unescaped wildcards in regex. The good news is that it's trivial to detect with static analysis tooling. The bad news is that broken regex is often used for security checks.

Sometimes I wish regexes were full matches by default and required prefixing and postfixing with `.*` to get the current behaviour

Re: Supply Chain Vuln Compromised Core AWS GitHub Repos & Threatened the AWS Console

#26

Post by SkiFire13 »

chuckadams wrote: post #15
bflesch wrote: post #6

Earlier quoted context omitted.

At least the vuln was old enough so that they couldn't blame AI for it, otherwise the article would read different ;)

Ironically (?) an AI code review would very likely have noticed the overly-permissive regex.

This doesn't really matter as long as they also find 10x more nits that create noise for the human reviewer.

Re: Supply Chain Vuln Compromised Core AWS GitHub Repos & Threatened the AWS Console

#28

Post by bstsb »

tnkuehne wrote: post #27

How did they create so many GitHub accounts? I used login with GitHub in the past to prevent spam but I feel like, after hearing this, I need to check for something like account age to prevent spam.

they explain in the article how they create hundreds of “bot” accounts using github apps, which seemingly aren't subject to the same rate limiting and captchas as user accounts

Re: Supply Chain Vuln Compromised Core AWS GitHub Repos & Threatened the AWS Console

#29

Post by ruined »

SkiFire13 wrote: post #25
bink wrote: post #14

Earlier quoted context omitted.

As a security dude I spend way too much of my time fixing missing anchors or unescaped wildcards in regex. The good news is that it's trivial to detect with static analysis tooling. The bad news is that broken regex is often used for security checks.

Sometimes I wish regexes were full matches by default and required prefixing and postfixing with `.*` to get the current behaviour

a match isn't boolean, it's substring. the original (and more common) use-cases would become excessively verbose

Re: Supply Chain Vuln Compromised Core AWS GitHub Repos & Threatened the AWS Console

#30

Post by rand846633 »

az226 wrote: post #24
btown wrote: post #12

> To escalate privileges, we abused the token’s repo scope, which can manage repository collaborators, and invited our own GitHub user to be a repository administrator. From everything I know about pentesting, they should have stopped before doing this, right? From https://hackerone.com/aws_vdp?type=team : > You may only interact with accounts you own or with explicit written permission from AWS or the account owner

It’s possible that AWS is a Wiz customer, which would allow them to do more stuff.

I’d guess that we would not have had the pleasure of reading this article if wiz was payed by AWS. There were multiple high impact bug in 2025 that we read about here, where security researchers had to turn down small six figure bounties to avoid NDAs…
Post reply on HN