Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

gist.github.com

Post reply on HN
Print view View original

271–280 of 453 posts

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#271

Post by rvnx »

llmslave2 wrote: post #267
rainonmoon wrote: post #260

Earlier quoted context omitted.

Except discord.com doesn't execute JavaScript, the user's browser does. These are meaningful distinctions that delineate the impact. You aren't "discord.com" if you target someone with an XSS exploit, you've only run a script in a user's session. Whether you can actually do anything with that script or not decides whether you can take over the account or not.

Everybody knows that XSS is a client side exploit, you're acting naive by pretending like we're claiming it gives access to a server and ignoring the fact that having control of the client gives you de facto control of whatever account is logged into the client.

It is not as cool as the RPC exploit of React/Next.js where you could call any function on the server-side including “vm.sysexec” or whatever it was, but still not to be fully ignored

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#272

Post by rvnx »

rainonmoon wrote: post #260
rvnx wrote: post #252

Earlier quoted context omitted.

Well, llmslave2 is right. If discord.com executes javascript to conduct user actions, and you can execute javascript on discord.com, you are acting on the account as if you were discord.com

Except discord.com doesn't execute JavaScript, the user's browser does. These are meaningful distinctions that delineate the impact. You aren't "discord.com" if you target someone with an XSS exploit, you've only run a script in a user's session. Whether you can actually do anything with that script or not decides whether you can take over the account or not.

Yes, I agree, it’s a cool discovery though

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#274

Post by whimsicalism »

td2 wrote: post #273
whimsicalism wrote: post #104

fascinating! but this is not a supply-chain attack unless i'm misunderstanding

It kinda is no? Discord uses mintlyfly. Minitlifly was vulnerable. And because they got access to mintlifly, discord was now also attackable

that’s just a vulnerability in a dependency. a supply-chain attack is introducing malicious code in a dependency

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#275

Post by johnny22 »

Blackthorn wrote: post #269
acheron wrote: post #181

Earlier quoted context omitted.

The Flash revisionism I see around here occasionally is bizarre. No, Flash was terrible and killing it was good.

There is artistically no equivalent to Flash ever since it died. Nothing else has allowed someone with artistic skills but no programming skills to create animations and games to the same degree and with the same ease.

what is missing was a replacement for the flash editor itself, not the format.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#276

Post by varenc »

This is a great example of why a Content-Security-Policy (CSP Header) should be considered mandatory for high risk sites. With it you can effectively tell the browser what JS is allowed to run, meaning that any JS injected via XSS won't work.

I suspect Coinbase and others already use CSP.

https://en.wikipedia.org/wiki/Content_Security_Policy

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#277

Post by staticassertion »

bobbylarrybobby wrote: post #15
dllu wrote: post #5

The fact that SVG files can contain scripts was a bit of a mistake. On one hand, the animations and entire interactive demos and even games in a single SVG are cool. But on the other hand, it opens up a serious can of worms of security vulnerabilities. As a result, SVG files are often banned from various image upload tools, they do not unfurl previews, and so on. If you upload an SVG to discord, it just shows the raw…

Would it be possible for messenger apps to simply ignore tags (and accept that this will break a small fraction of SVGs)? Or is that not a sufficient defense?

No, svgs can do `onload` and `onerror` and also reference other svgs that can themselves contain those things (base64'd or behind a URI).

But you can use an `img` tag (``) and that'll basically Just Work, or use a CSP. I wouldn't rely on sanitizing, but I'd still sanitize.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#279

Post by staticassertion »

rslashuser wrote: post #182
css_apologist wrote: post #120

Earlier quoted context omitted.

is santizing SVGs hard, or just everyone forgets they can contain js?

I gather from the HN discussion that it's not simple to disable scripting in an SVG, in retrospect a tragically missing feature. I guess the next step is to propose a simple "noscripting" attribute, which if present in the root of the SVG doc inhibits all scripting by conforming renderers. Then the renderer layer at runtime could also take a noscripting option, so the rendering context could force it if appropriate.…

Disabling script execution in svgs is very easy, it's just also easy to not realize you're about to embed an svg. `` will not execute scripts, a bit like your "noscripting" attribute except it's already around and works. Content Security Policy will prevent execution as well, you should be setting one for image endpoints that blocks scripts.

Sanitizing is hard to get right by comparison (svgs can reference other svgs) but it's still a good idea.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#280

Post by staticassertion »

tick_tock_tick wrote: post #185
llmslave2 wrote: post #22

This feels so emblematic of our current era. VC funded vibe coded AI documentation startup somehow gets big name customers who don't properly vet the security of the platform, ship a massive vulnerability that could pwn millions of users and the person who reports the vulnerability gets...$5k. If I recall last week Mintlify wrote a blog post showcasing their impressive(ly complicated) caching architecture. Pretending…

The issue is everyone loves to have everything fronted by a single domain. Most of xss is because of this basic flaw. All of this could have been avoided if discord didn't run their API docs through discord.com

This is what it really comes down to. Browsers are built around origins as the major security boundary. When you use a separate origin, safety comes for free.
Post reply on HN