4 ms·

If there's a supposed to be a 90 day disclosure lag, why is this on hacker news today?

i336_ 10y ago
It got fixed. Note the discussion about high turnaround time. EDIT: The better technical term would be "arguably patched." See reply below.
- deathanatos 10y ago
  > It got fixed. Just so that nobody reading the comments gets the wrong idea: read the whole discussion. Fixed here seems very subjective; they only seem to have limited the extension to the webex.com domain. In particular, > although this does mean any XSS on webex.com would allow remote code execution and > doesn't use HTTP Strict Transport Security, either as a header or by being preloaded My understanding is that this means that not only would any XSS on webex.com lead to possible exploitation, but also that anyone who can MitM your machine, such as in a coffee shop, and use that to gain remote execution by intercepting and faking a request to an unsecured webex.com. (Since no HSTS is in place, the browser would allow it.) The latter is less likely, but nonetheless, this extension seems to allow anyone who can talk to it an RCE, which seems far from fixed.
  - i336_ 10y ago
    Very good point. My comment is <1h old so I was able to edit it. IMO this issue was unsealed a little hastily; yes, it's not directly attackable now, but as you say the attack vector is still technically there.
  - spyder 10y ago
    Yeah, after a quick look I already found an XSS on a *.webex.com subdomain, but it only works in Internet Explorer and Edge because these browsers doesn't escape URLs, so it doesn't affect the Chrome or Firefox extensions but tells something about how secure these subdomains are (and the IE browsers).
  - kevin_b_er 10y ago
    Loading any insecure page on a hostile network is an instant remote unprompted code execution exploit with this extension installed.
  - rahilb 10y ago
    even worse, there is no X-Frame-Options header, so an attacker needn't bother with a MITM: Just set up a page with an iframe...
gsnedders 10y ago
The disclosure is at min(fix_date, report_date + 90 days).

i336_ 10y ago

It got fixed. Note the discussion about high turnaround time. EDIT: The better technical term would be "arguably patched." See reply below.

deathanatos 10y ago
> It got fixed. Just so that nobody reading the comments gets the wrong idea: read the whole discussion. Fixed here seems very subjective; they only seem to have limited the extension to the webex.com domain. In particular, > although this does mean any XSS on webex.com would allow remote code execution and > doesn't use HTTP Strict Transport Security, either as a header or by being preloaded My understanding is that this means that not only would any XSS on webex.com lead to possible exploitation, but also that anyone who can MitM your machine, such as in a coffee shop, and use that to gain remote execution by intercepting and faking a request to an unsecured webex.com. (Since no HSTS is in place, the browser would allow it.) The latter is less likely, but nonetheless, this extension seems to allow anyone who can talk to it an RCE, which seems far from fixed.
- i336_ 10y ago
  Very good point. My comment is <1h old so I was able to edit it. IMO this issue was unsealed a little hastily; yes, it's not directly attackable now, but as you say the attack vector is still technically there.
- spyder 10y ago
  Yeah, after a quick look I already found an XSS on a *.webex.com subdomain, but it only works in Internet Explorer and Edge because these browsers doesn't escape URLs, so it doesn't affect the Chrome or Firefox extensions but tells something about how secure these subdomains are (and the IE browsers).
- kevin_b_er 10y ago
  Loading any insecure page on a hostile network is an instant remote unprompted code execution exploit with this extension installed.
- rahilb 10y ago
  even worse, there is no X-Frame-Options header, so an attacker needn't bother with a MITM: Just set up a page with an iframe...

gsnedders 10y ago

The disclosure is at min(fix_date, report_date + 90 days).