Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

gist.github.com

Post reply on HN
Print view View original

331–340 of 453 posts

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#331

Post by antiloper »

MarsIronPI wrote: post #179
demurgos wrote: post #27

Earlier quoted context omitted.

I looked into it for work at some point as we wanted to support SVG uploads. Stripping is not enough to have an inert file. Scripts can also be attached as attributes. If you want to prevent external resources it gets more complex. The only reliable solution would be an allowlist of safe elements and attributes, but it would quickly cause compat issues unless you spend time curating the rules. I did not find an exist…

Shouldn't the ignoring of scripting be done at the user agent level? Maybe some kind of HTTP header to allow sites to disable scripts in SVG ala CORS?

Content-Security-Policy: default-src 'none'

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#332

Post by DoctorOW »

codedokode wrote: post #330

It is clear that SVG should not support scripts and CSS in SVG files. Those who need them can simply create HTML with inline SVG tags and scripts. And SVG should contain only shapes, effects and transformations. Or maybe we need a new image format, "SVG without scripts and CSS".

CSS and scripts are wildly different. It's like responding to the old MS Office attacks with "Word without macros or font selection"

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#333

Post by gavinray »

Alex-Programs wrote: post #323
fergie wrote: post #316

Earlier quoted context omitted.

I feel like the "I'm a 16 year old high school senior" thing is some kind of social engineering- his knowledge seems a bit too broad. But who knows.

There are plenty of competent 16 year olds.

I just read a story about a 13-year-old awarded a Ph. D at a prestigious university.

Human intelligence/aptitude has such extreme distributions it's almost unthinkable.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#335

Post by netdevphoenix »

jdsleppy wrote: post #178
superasn wrote: post #128

This is a pretty scary exploit, considering how easily it could be abused. Imagine just one link in a tweet, support ticket, or email: https://discord.com/_mintlify/static/evil/exploit.svg . If you click it, JavaScript runs on the discord.com origin. Here's what could happen: - Your Discord session cookies and token could be stolen, leading to a complete account takeover. - read/write your developer applications & we…

Doesn't stealing the cookies/token require a non-HTTP-only session cookie or a token in localstorage? Do you know that Discord puts their secrets in one of those insecure places, or was it just a guess? I believe if you always keep session cookies in secure, HTTP-only cookies, then you are more resilient to this attack. I interviewed frontend devs last year and was shocked how few knew about this stuff.

Surely, if a script is in a position to sniff the cookie from local storage, they can also indirectly use the http-only cookie by making a request from the browser. So really not much of a difference as they will be taking over the account

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#336

Post by imdsm »

snvzz wrote: post #133
superasn wrote: post #128

This is a pretty scary exploit, considering how easily it could be abused. Imagine just one link in a tweet, support ticket, or email: https://discord.com/_mintlify/static/evil/exploit.svg . If you click it, JavaScript runs on the discord.com origin. Here's what could happen: - Your Discord session cookies and token could be stolen, leading to a complete account takeover. - read/write your developer applications & we…

>the $4,000 bounty feels like a slap in the face. And serves a reminder crime does pay. In the black market, it would have been worth a bit more.

I was once only given $1,000 for an exploit where I could put in npm usernames and get their email addresses. Big corps don't always pay what they should.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#338

Post by arethuza »

socketcluster wrote: post #314
edoceo wrote: post #291

Earlier quoted context omitted.

Is that a problem on its own? It's like, encrypted right? Maybe a time sensitive token?

Not a problem in itself. Also, there's not much point of encrypting tokens. The attacker could use the encrypted token to authenticate themselves without having to decrypt. They could just make a request from the victim's own browser. They could do this with cookies too even with httpOnly cookies. XSS is a big problem. If a hacker can inject a script into your front end and make it execute, it's game over. Once they…

Does anyone actually encrypt the contents of JWTs? I'd have thought that anyone who has concerns about the contents of the token being easily visible would be likely to avoid JWTs anyway and just use completely opaque tokens?

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#339

Post by brap »

mock-possum wrote: post #322
staticassertion wrote: post #280

Earlier quoted context omitted.

This is what it really comes down to. Browsers are built around origins as the major security boundary. When you use a separate origin, safety comes for free.

Trust doesn’t though - discord.com/docs looks legit, as does docs.discord.com - discord-docs.com immediately sets off red flags

Is there no way to tell the browser “hey this URL is using the same domain but please isolate it from the rest”?

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#340

Post by jrflowers »

tptacek wrote: post #228
notnullorvoid wrote: post #224

Earlier quoted context omitted.

This specific XSS vulnerability may not have been, but the linked RCE vulnerability found by their friend https://kibty.town/blog/mintlify/ certainly would've been worth more than the $5,000 they were awarded. A vulnerability like that (or even a slightly worse XSS that allowed serving js instead of only svg) could've let them register service workers to all visiting users giving future XSS ability at any time, even…

Maybe? I don't know enough about the vulnerability. Is it serverside? Then it isn't worth very much.

>i quickly realised that this was the server-side serverless (lol) environment of their main documentation app, while this calls to a external api to do everything, we have the token it calls it with in the env.

>alongside, we can poison the nextjs cache for everyone for any site, allowing mass xss, defacing, etc on any docs site.

Post reply on HN