Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

gist.github.com

Post reply on HN
Print view View original

351–360 of 453 posts

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#351

Post by integralid »

staticassertion wrote: post #280
tick_tock_tick wrote: post #185

Earlier quoted context omitted.

The issue is everyone loves to have everything fronted by a single domain. Most of xss is because of this basic flaw. All of this could have been avoided if discord didn't run their API docs through discord.com

This is what it really comes down to. Browsers are built around origins as the major security boundary. When you use a separate origin, safety comes for free.

And you open another can of worms which is phishing. If you run your marketing campaigns from yourcompany-deals-2025.com don't be surprised when people click yourcompany-login.com links

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#353

Post by integralid »

philipwhiuk wrote: post #344
0xbadcafebee wrote: post #40

How these companies don't hire kids like Daniel for pennies on the dollar and have him attack their stacks on a loop baffles me. Pay the kid $50k/yr (part time, he still needs to go to school) to constantly probe your crappy stacks. Within a year or two you'll have the most goddamn secure company on the internet - and no public vulns to embarrass you.

I doubt it. Just because he found one vulnerability at one vendor used by Discord doesn't mean he'll find all the vulnerabilities that exist at Discord or indeed any of them.

TFA:

>Discord is one of my favorite places to hunt for vulnerabilities since I'm very familiar with their API and platform. I'm at the top of their bug bounty leaderboard having reported nearly 100 vulnerabilities over the last few years. After you've gone through every feature at least 10 times, it gets boring.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#354

Post by Pxtl »

dllu wrote: post #5

The fact that SVG files can contain scripts was a bit of a mistake. On one hand, the animations and entire interactive demos and even games in a single SVG are cool. But on the other hand, it opens up a serious can of worms of security vulnerabilities. As a result, SVG files are often banned from various image upload tools, they do not unfurl previews, and so on. If you upload an SVG to discord, it just shows the raw…

What we got was html for vector graphics and what we wanted was jpeg for vector graphics.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#355

Post by GoblinSlayer »

0x3f wrote: post #222
rvnx wrote: post #216

Earlier quoted context omitted.

Why would that be the maximum damage ? This XSS is particularly dangerous because you are running your script on the same domain where the user is logged-in so you can pretty much do anything you want under his session. In addition this is widespread. It's golden for any attacker.

Because modern cookie directives and browser configs neuter a lot of the worst XSS outcomes/easiest exploit paths. I would expect all the big sites to be setting them, though I guess you never know.

AIU this feature is SSS, not XSS, so XSS protections don't apply.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#356

Post by z3t4 »

jdsleppy wrote: post #178
superasn wrote: post #128

This is a pretty scary exploit, considering how easily it could be abused. Imagine just one link in a tweet, support ticket, or email: https://discord.com/_mintlify/static/evil/exploit.svg . If you click it, JavaScript runs on the discord.com origin. Here's what could happen: - Your Discord session cookies and token could be stolen, leading to a complete account takeover. - read/write your developer applications & we…

Doesn't stealing the cookies/token require a non-HTTP-only session cookie or a token in localstorage? Do you know that Discord puts their secrets in one of those insecure places, or was it just a guess? I believe if you always keep session cookies in secure, HTTP-only cookies, then you are more resilient to this attack. I interviewed frontend devs last year and was shocked how few knew about this stuff.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#357

Post by sammy2255 »

wiether wrote: post #302
sammy2255 wrote: post #119

Earlier quoted context omitted.

They've already proved themselves as competent. $50k a year to a billion dollar company is nothing. Even if they find 0 vulnerabilities a year it's still worth it to them

So now they found a vulnerability, the company should pay them $50k a year until they retire because they proved themselves competent?

Yes?

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#358

Post by Aachen »

kenjackson wrote: post #151
Illniyar wrote: post #19

Nice discovery and writeup. Let alone for a 16 yo!. I've never heard an XSS vulnerability described as a supply-chain attack before though, usually that one is reserved for package managers malicious scripts or companies putting backdoors in hardware.

I think you can view it as supply chain as the supply chain is about attacking resources used to infiltrate downstream (or is it upstream? I get which direction I should think this flows). As an end user you can't really mitigate this as the attack happens in the supply chain (Mintlify) and by the time it gets to you it is basically opaque. It's like getting a signed malicious binary. It looks good to you and the tru…

A supply chain attack attacks the supply chain

This makes use of a vulnerability in a dependency. If they had recommended, suggested, or pushed this purposefully vulnerable code to the dependency, then waited for a downstream (such as Discord) to pull the update and run the vulnerable code, then they would have completed a supply chain attack

The whole title is bait. Nobody would have heard of the dependency, so they don't even mention it, just call it "a supply chain" and drop four big other names that you have heard of to make it sexy. One of them was actually involved that I can tell from the post, that one is somewhat defensible. They might as well have written in the title that they've hacked the pentagon, if someone in there uses X and X had this vulnerable dependency, without X or the pentagon ever being contacted or involved or attacked

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#359

Post by Aachen »

tptacek wrote: post #41
llmslave2 wrote: post #22

This feels so emblematic of our current era. VC funded vibe coded AI documentation startup somehow gets big name customers who don't properly vet the security of the platform, ship a massive vulnerability that could pwn millions of users and the person who reports the vulnerability gets...$5k. If I recall last week Mintlify wrote a blog post showcasing their impressive(ly complicated) caching architecture. Pretending…

I don't think anybody in SFBA-style software development, both pre- and post-LLM, is really resilient against these kinds of attacks. The problem isn't vibe coding so much as it is multiparty DLL-hell dependency stacks, which is something I attribute more to Javascript culture than to any recent advance in technology.

That's "San Francisco Bay Area" for anyone else wondering

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#360

Post by Aachen »

integralid wrote: post #353
philipwhiuk wrote: post #344

Earlier quoted context omitted.

I doubt it. Just because he found one vulnerability at one vendor used by Discord doesn't mean he'll find all the vulnerabilities that exist at Discord or indeed any of them.

TFA: >Discord is one of my favorite places to hunt for vulnerabilities since I'm very familiar with their API and platform. I'm at the top of their bug bounty leaderboard having reported nearly 100 vulnerabilities over the last few years. After you've gone through every feature at least 10 times, it gets boring.

That doesn't specify how many bugs there existed in the Discord codebase throughout the time where this person was active. Only once you know that, can you say whether they found a significant proportion relative to the effort they've spent and would spend as a part-time employee. That other people still find things also suggests that the statement above ("just hire him and you're secure") might have been a bit simplistic
Post reply on HN