How to hack Discord, Vercel and more with one easy trick(kibty.town)
170 pointsby todsacerdoti2 days ago11 comments
  • llmslave22 days ago
    This feels so emblematic of our current era. VC funded vibe coded AI documentation startup somehow gets big name customers who don't properly vet the security of the platform, ship a massive vulnerability that could pwn millions of users and the person who reports the vulnerability gets...$5k.

    If I recall last week Mintlify wrote a blog post showcasing their impressive(ly complicated) caching architecture. Pretending like they were doing real engineering, when it turns out nobody there seems to know what they're doing, but they've managed to convince some big names to use them.

    Man, it's like everything I hate about modern tech. Good job Eva for finding this one. Starting to think that every AI startup or company that is heavily using gen-ai for coding is probably extremely vulnerable to the simplest of attacks. Might be a way to make some extra spending money lol.

    • tptacek2 days ago
      This is identical to a comment you wrote on the other story about these vulnerabilities that's higher up on the front page, which isn't great.
    • subscribed2 days ago
      You bet not all THW vulnerabilities are reported to the vendors. Not with 5k bounty for THAT.
      • llmslave22 days ago
        Yeah thats the scary thing. I know it's a bit of a meme about how as programmers we don't trust other programmers or software, but it's becoming more and more true and necessary. I want to use as little software as possible these days.
      • guizadillas2 days ago
        Yeah it made me re-evaluate how much I can trust those platforms
      • dfc2 days ago
        THW?
    • gruez2 days ago
      > This feels so emblematic of our current era. VC funded vibe coded AI documentation startup somehow ...

      Is there any indication Mintify was "vibe coded"?

      • llmslave22 days ago
        I'm giving them the benefit of the doubt, as the alternative would be that their developers are completely incompetent. The vulnerability is the equivalent to letting a user save HTML to a database and then injecting it into every page completely unsanitized.
        • agosta2 days ago
          Mintlify had a blacklist in place to not allow them to do this with most file types. Someone failed to add SVG to it. It's not like they weren't thinking about security. The challenge with security, as you know, is it's only as strong as it's weakest link. It only takes one ignorant/incompetent person in an entire organization to jeopordize the org. But even a competent person can make a crucial mistake.
          • pmontra2 days ago
            A whitelist is safer than a blacklist. Unfortunately you risk losing those customers that won't be able to load their media, won't contact support, will use a different service.
          • sofixa2 days ago
            > It's not like they weren't thinking about security

            https://kibty.town/blog/mintlify/

            The first CVE here definitely sounds like they absolutely weren't thinking care security.

          • anonymous9082132 days ago

              The challenge with security, as you know, is it's only as strong as it's weakest link. It only takes one ignorant/incompetent person in an entire organization to jeopordize the org.
            This statement could not be further from the truth. Your organization itself is completely incompetent if one ignorant employee can compromise it. The "swiss cheese" safety memetic is widely understood and basically common sense; in an actually competent organization, no single person has sole responsibility for success or failure of a process, and it takes individual failures at multiple levels to result in process failure.
            • esseph2 days ago
              I agree with you in theory.

              In practice, I've never known a single organization to hit that bar. Ever.

    • scratchee2 days ago
      A similar comment was posted on the PostHog post yesterday. Claiming everything is vibe coded without any proof is pure rage bait.
      • 2 days ago
        undefined
    • agosta2 days ago
      Chill - just because someone got hacked doesn't mean their product is trash. Easily every mass adopted product created prior to 2023 has been hacked at some point.
      • fao_2 days ago
        That makes it worse, not better. Because for those applications the code was audited and not hallucinated.
      • sofixa2 days ago
        > Chill - just because someone got hacked doesn't mean their product is trash

        Yes, but the vulnerabilities reported in this collection of articles really smell like trash. Allowing untrusted code from your customers to be executed in a shared environment with no isolation is like, extremely amateurish.

    • brazukadeva day ago
      Why did you post the same comment twice? This is not Reddit, my friend.
  • ollybee2 days ago
    How is a company like mintlify getting so many big name customers for what appears to be a static site generator + hosting? Is there some secret sauce I'm missing, what is the value proposition?
    • zeroq2 days ago
      fun fact: last BigCo I worked in had an elaborate architecture/security bar for new applications/features but offered a clever workaround - you could use a pre-approved solution and skip numerous quality checks and approvals, so every single PO was pushing for that specific solution.

      The result? A static html with 500 ppl audience was billing a whooping 2k EUR a month, because that was the cost of that pre-approved architecture.

      Best part - I was championing a company wide solution for that problem for over a year, which resulted in board level special operation with 100k budget only to get that budget snugged by people couple steps above the ladder.

    • josegonzalez2 days ago
      Lots of these companies are YC companies, and they tend to use other YC products. For those that aren't, its easier to just use what other big names are using, and having YC as a backing name is quite useful in that regard.
    • tommica2 days ago
      Convenience and developer uncertainty. I fall pray to the "it's paid, so it must be better" fallacy, and the "they know what they are doing, they are pros" illogicality.
    • sofixa2 days ago
      I genuinely don't know, especially for Vercel to be using them. Vercel themselves can easily be used to host static-ish documentation.

      But it looks like Mintlify are using Vercel on the backend: https://vercel.com/blog/mintlify-scaling-a-powerful-document...

      So it's just a Vercel wrapper?

  • 2 days ago
    undefined
  • 2 days ago
    undefined
  • rampatraa day ago
    Wow this is interesting, however, the reward seems way too less to me.
  • sans_souse2 days ago
    $5k is such a small payout for this sort of finding.
    • arcwhite2 days ago
      It's actually pretty on-par for most bug bounties. They used the same exploit on a few programs and got $11k total which ain't bad return on time.
      • sans_souse2 days ago
        No I know it's on par I guess better rephrasing would be the par is still too low
        • arcwhite2 days ago
          Compared to what? What's your baseline for how much a user-interaction-required XSS vulnerability should be worth?
          • sans_sousea day ago
            I'm not basing it on math.

            Are you saying tho that 2.5k wouldhave been adequate in 2019? I expect 5k would have been on par then too. But idk

  • ChrisArchitect2 days ago
    Related:

    We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

    https://news.ycombinator.com/item?id=46317098

  • frandroid2 days ago
    > alongside, we can poison the nextjs cache for everyone for any site,

    What??

  • vjay152 days ago
    wow it felt like they were playing around lol
  • sigseg1v2 days ago
    isn't this actually XSRF and worse than XSS?

    Also, if users can run arbitrary JS on someone else's server then what stops them from doing CPU-bound work such as crypto miners?