Have you raised an issue on github for this? Its the best way to inform the devs.
Cybersecurity
c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.
THE RULES
Instance Rules
- Be respectful. Everyone should feel welcome here.
- No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
- No Ads / Spamming.
- No pornography.
Community Rules
- Idk, keep it semi-professional?
- Nothing illegal. We're all ethical here.
- Rules will be added/redefined as necessary.
If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.
Learn about hacking
Other security-related communities [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
Notable mention to [email protected]
Damn... seems like there should be filtering to only allow http:
and https:
URIs...
Did you try the security email on github? I sent a vulnerability (that actually is way fucking worse than I thought given this issue) over a week ago and have heard nothing, so will be posting publicly soon.
Holy shit holy shit holy shit. Serious vulnerability confirmed. Combined with the issue(s) I have tried to report this is insane. I just tested this (and purged it so as not to publicly disclose just yet). This is really bad.
Does the default CSP do anything to mitigate this?
I believe if unsafe-inline
were removed from script-src
then the CSP would block this.
If the frontend depends on inline script tags then this likely can't be changed super easily... The fact that unsafe-eval
is in script-src
is kinda worrying as well. Ideally you would lock the CSP down a lot more than they have.
Aye, I am pretty sure CSP is bypass-able in most situations unless your pinning checksums or hashes. Just thought it might help take the edge off the hacker panic.
Yeah, it can certainly help in some cases, defense in depth and all that. If the CSP were 'self' (allowing any JS hosted on your domain) this would probably be DoA. Sadly, until the frontend stops using <script>
to set things on window
to hydrate state from SSR to client-side they won't be able to change it without breaking things.