Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

research.kudelskisecurity.com

Post reply on HN
Print view View original

231–240 of 244 posts

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#231

Post by morgante »

smarx007 wrote: post #208
morgante wrote: post #152

Yikes, this is a pretty bad vulnerability. It's good that they fixed it, but damning that it was ever a problem in the first place. Rule #1 of building any cloud platform analyzing user code is that you must run analyzers in isolated environments. Even beyond analysis tools frequently allowing direct code injection through plugins, linters/analyzers/compiler are complex software artifacts with large surface areas for…

How was the sandbox implemented? Just a one-off Docker container execution or something more substantial?

We built on firecracker VMMs but today I'd just use a hosted provider like morph.so or e2b.dev.

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#232

Post by [deleted] »

viraptor wrote: post #168
singleshot_ wrote: post #156

Earlier quoted context omitted.

> Unless there was any breach of customer information (and that can be often verified), there are typically no legal requirements. If the company is regulated by the SEC I believe you will find that any “material” breach is reportable after the determination of materiality is reached, since at least 2023.

Sure. And these types of "we fixed it and confirmed nobody actually exploited it" issues are not always treated as material. You can confirm that for example by checking SEC reports for each cve in commercial VPN gateways... or lack of.

[deleted]

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#235

Post by rglynn »

KingOfCoders wrote: post #210
megamorf wrote: post #204

Earlier quoted context omitted.

The security researcher noticed that CodeRabbit runs linters against your code base and noticed that Rubocop was among the provided linters. Rubocop supports extensions that contain custom code, so he crafted an extension that exfiltrated the environment variables of the running Rubocop process when it linted the contents of his PR.

But where does the configuration for Rubocop come from? From CodeRabbit (e.g. you configure it on their server for your repo), from the repository or (new) config files in the PR?

Both the repo and new config in the PR.

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#236

Post by Jap2-0 »

neandrake wrote: post #180
Jap2-0 wrote: post #167

Earlier quoted context omitted.

Hmm, is it normal practice to rotate secrets before fixing the vulnerability?

They first disabled rubocop to prevent further exploit, then rotated keys. If they awaited deploying the fix that would mean letting compromised keys remain valid for 9 more hours. According to their response all other tools were already sandboxed. However their response doesn't remediate putting secrets into environment variables in the first place - that is apparently acceptable to them and sets off a red flag for…

Duh. Thanks for pointing that out.

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#237

Post by raggi »

jeremyjh wrote: post #169
raggi wrote: post #144

Earlier quoted context omitted.

I love this implication that there's some valuable body of code out there that gets reviewed, compiled and never executed.

They are talking about executing code at compile time (macros and such). With modern IDEs/editors, just opening the folder may trigger such behavior (when LSP boots and compiles) though some environments warn you.

I know, but the _implication_ is that it's extremely unsafe, I don't buy the implication - code gets executed.

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#238

Post by wredcoll »

moomoo11 wrote: post #165
wredcoll wrote: post #136

Earlier quoted context omitted.

This post would have a lot more meaning if "vibe coders" were the only ones making security mistakes that involved thousands of customers.

Yeah you're right. Your post would have a lot more meaning if you would realize that the rate at which security mistakes are occurring is about to explode (if not already). That's like saying if/when an AV runs over a bunch of people that its not like they're the only ones running over people human drivers do it too! Thankfully, Waymo which I use regularly is fkin awesome and actually works. Then again, they're not v…

> That's like saying if/when an AV runs over a bunch of people that its not like they're the only ones running over people human drivers do it too!

I mean, that's literally what happened? Computer controlled cars were developed, killed some people, and everyone collectively shrugged and went on with their lives. A large part of that reaction was probably because we're all immersed in a culture that just expects some number of people to die because of cars every year.

Re: How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos

#239

Post by strbean »

moomoo11 wrote: post #165
wredcoll wrote: post #136

Earlier quoted context omitted.

This post would have a lot more meaning if "vibe coders" were the only ones making security mistakes that involved thousands of customers.

Yeah you're right. Your post would have a lot more meaning if you would realize that the rate at which security mistakes are occurring is about to explode (if not already). That's like saying if/when an AV runs over a bunch of people that its not like they're the only ones running over people human drivers do it too! Thankfully, Waymo which I use regularly is fkin awesome and actually works. Then again, they're not v…

> That's like saying if/when an AV runs over a bunch of people that its not like they're the only ones running over people human drivers do it too!

Well, what matters most is how much they run over people relative to human drivers. People often act like "even once is too many!", ignoring that fact that no, once is not too many, if it's less than what is already happening.

Post reply on HN