Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Six Harmless Bugs Lead to Remote Code Execution

mehmetince.net

Post reply on HN
Print view View original

1–10 of 29 posts

Re: Six Harmless Bugs Lead to Remote Code Execution

#4

Post by arcfour »

kichik wrote: post #3

Nice chain and write-up. I don't know that I would call eval() on user input, hard coded secrets, and leaked credentials small or harmless. All of those are scary on their own.

Yeah...and the fact that they evidently had no responsible disclosure process and ghosted the reporter...for a security product?!

Big yikes.

Re: Six Harmless Bugs Lead to Remote Code Execution

#5

Post by x0x0 »

This writeup is great, particularly the discussion of how Mehmet worked through understanding the system.

That said, Logpoint sell a siem product w/o a vulnerability intake process and that can't manage to rapidly patch pre-auth RCE security holes. There's nothing to say besides Logpoint are not serious people and nobody should use their nonsense. Given the number of bugs found and the surface level depth, security wasn't even an afterthought; it was not thought about at all.

Re: Six Harmless Bugs Lead to Remote Code Execution

#8

Post by patates »

boston_clone wrote: post #7
AlienLang wrote: post #6

[flagged]

Thanks, ChatGPT.

For fun (not because I'm trying to defend the capabilities of LLMs, but really just out of boredom), I tried to make this better with this prompt:

> make this sound less AI-generated and more like a proper hacker news comment with some SUBSTANCE: (insert the OP comment from above)

and Gemini 3 Flash generated this:

> This is exactly why CVSS scores can be misleading in practice. You see this constantly at Pwn2Own: it’s rarely one massive architectural failure, but a daisy-chain of three or four "low severity" quirks—an info leak here, a minor logic error there.

> To a product manager, these look like edge cases or wontfix tickets. But to an attacker, they aren't bugs; they’re primitives. You use the info leak to bypass ASLR, the logic error to groom the heap, and suddenly a nuisance crash becomes full RCE. We tend to model threats based on distinct barriers, ignoring that the complexity of the system guarantees these gadgets will eventually align.

It feels like it's fun when one plays with it on their own but it's really boring when reading the content others have generated (and therefore I'm sorry for adding to the pile - just wanted to see if the "HN style" was already baked-in to the LLMs and share the result: Yes it is).

Re: Six Harmless Bugs Lead to Remote Code Execution

#9

Post by jacquesm »

patates wrote: post #8
boston_clone wrote: post #7

Earlier quoted context omitted.

Thanks, ChatGPT.

For fun (not because I'm trying to defend the capabilities of LLMs, but really just out of boredom), I tried to make this better with this prompt: > make this sound less AI-generated and more like a proper hacker news comment with some SUBSTANCE: (insert the OP comment from above) and Gemini 3 Flash generated this: > This is exactly why CVSS scores can be misleading in practice. You see this constantly at Pwn2Own: it…

I wished there was a 9th bit that we could use to tag AI generated content with.

Re: Six Harmless Bugs Lead to Remote Code Execution

#10

Post by patates »

jacquesm wrote: post #9
patates wrote: post #8

Earlier quoted context omitted.

For fun (not because I'm trying to defend the capabilities of LLMs, but really just out of boredom), I tried to make this better with this prompt: > make this sound less AI-generated and more like a proper hacker news comment with some SUBSTANCE: (insert the OP comment from above) and Gemini 3 Flash generated this: > This is exactly why CVSS scores can be misleading in practice. You see this constantly at Pwn2Own: it…

I wished there was a 9th bit that we could use to tag AI generated content with.

9th bit is the color:

> I think it's time for computer people to take Colour more seriously

Source: https://ansuz.sooke.bc.ca/entry/23 , "What Colour are your bits?"

Post reply on HN