4 ms·

> Wait for the cdnjs library update server to process the crafted .tgz file. I'm a bit confused... how did they get their updates pushed to a repo they didn't

> Wait for the cdnjs library update server to process the crafted .tgz file. I'm a bit confused... how did they get their updates pushed to a repo they didn't control?

lalaland1125 5y ago
cdnjs will mirror any npm package They didn't update any part of cdnjs itself. Instead, they triggered cdnjs on their package.
- jtsiskin 5y ago
  Do they? Their website https://cdnjs.com/libraries https://cdnjs.com/libraries says "Couldn't find the library you're looking for? You can make a request to have it added on our GitHub repository." Amusingly you can see the "hey-sven" library they added to test the fix: https://github.com/cdnjs/packages/pull/695 https://github.com/cdnjs/packages/pull/695 If you download the tarball directly, https://registry.npmjs.org/hey-sven/-/hey-sven-1.0.2.tgz https://registry.npmjs.org/hey-sven/-/hey-sven-1.0.2.tgz, then tar -ztvf hey-sven-1.0.2.tgz, you can see -rw-r--r-- 0 ryotak staff 204 Jun 2 16:21 package/package.json -rw-r--r-- 0 ryotak wheel 10 Jun 2 16:21 ../../../../../../../../../../tmp/ryotak -rw-r--r-- 0 ryotak wheel 10 Jun 2 16:22 ../../../../../../../../../../tmp/ryotak.sh both which just have the contents "Retesting"
  - aylux2121 5y ago
    I'm just trying to find the root cause. I see that is PR is merged by a contributor "xtuc". Root question is that why was this PR merged? Apart from reading/writing to other files in the build pipeline instance (which is a really good catch), primary problem I see here is that anyone is able to deploy any arbitrary code/javascript to serve it from cdnjs. Just send a PR, then some contributor will merge it without checking the release package content. Don't you think that is open to a lot of issues?
- alfiedotwtf 5y ago
  Ah. Nice.
- MattIPv4 5y ago
  Just to clarify, we won't just mirror any npm package. We have a set list of git repos and npm packages that we pull from, and adding a new one requires a PR to our packages repo which a human must review.
  - NotEvil 5y ago
    Okay, then how was OP able to push that symlink library. Dis he use an already approved library or submitted a new one. Because if he did that symlink should at least raised some eyebrows at least
shoo 5y ago
echoing lalaland's comment, this diagram may give context about how changes to js libraries (incl hostile payloads, as in this example) flow through cdnjs: https://blog.cloudflare.com/content/images/2019/12/1-with-arrow-v2-1.png https://blog.cloudflare.com/content/images/2019/12/1-with-ar... from 2019/12/20 cloudflare blog post about cdnjs project: https://blog.cloudflare.com/an-update-on-cdnjs/ https://blog.cloudflare.com/an-update-on-cdnjs/
- jtsiskin 5y ago
  but this implies they own one of the repositories in https://cdnjs.com/libraries https://cdnjs.com/libraries?
  - shoo 5y ago
    yes, that's my guess. there's 4051 of the things. or maybe there's another exploit to publish a bad version of someone else's package to npm that is already approved to have new versions mirrored by cdnjs robots ( i have no evidence that this was done in this case, but an attacker might be able to do it. there's a lot of surface area to attack in build & release pipeline of 4000+ packages )

> Wait for the cdnjs library update server to process the crafted .tgz file. I'm a bit confused... how did they get their updates pushed to a repo they didn't control?

lalaland1125 5y ago

cdnjs will mirror any npm package They didn't update any part of cdnjs itself. Instead, they triggered cdnjs on their package.

jtsiskin 5y ago
Do they? Their website https://cdnjs.com/libraries https://cdnjs.com/libraries says "Couldn't find the library you're looking for? You can make a request to have it added on our GitHub repository." Amusingly you can see the "hey-sven" library they added to test the fix: https://github.com/cdnjs/packages/pull/695 https://github.com/cdnjs/packages/pull/695 If you download the tarball directly, https://registry.npmjs.org/hey-sven/-/hey-sven-1.0.2.tgz https://registry.npmjs.org/hey-sven/-/hey-sven-1.0.2.tgz, then tar -ztvf hey-sven-1.0.2.tgz, you can see -rw-r--r-- 0 ryotak staff 204 Jun 2 16:21 package/package.json -rw-r--r-- 0 ryotak wheel 10 Jun 2 16:21 ../../../../../../../../../../tmp/ryotak -rw-r--r-- 0 ryotak wheel 10 Jun 2 16:22 ../../../../../../../../../../tmp/ryotak.sh both which just have the contents "Retesting"
- aylux2121 5y ago
  I'm just trying to find the root cause. I see that is PR is merged by a contributor "xtuc". Root question is that why was this PR merged? Apart from reading/writing to other files in the build pipeline instance (which is a really good catch), primary problem I see here is that anyone is able to deploy any arbitrary code/javascript to serve it from cdnjs. Just send a PR, then some contributor will merge it without checking the release package content. Don't you think that is open to a lot of issues?
alfiedotwtf 5y ago
Ah. Nice.
MattIPv4 5y ago
Just to clarify, we won't just mirror any npm package. We have a set list of git repos and npm packages that we pull from, and adding a new one requires a PR to our packages repo which a human must review.
- NotEvil 5y ago
  Okay, then how was OP able to push that symlink library. Dis he use an already approved library or submitted a new one. Because if he did that symlink should at least raised some eyebrows at least

shoo 5y ago

echoing lalaland's comment, this diagram may give context about how changes to js libraries (incl hostile payloads, as in this example) flow through cdnjs: https://blog.cloudflare.com/content/images/2019/12/1-with-arrow-v2-1.png https://blog.cloudflare.com/content/images/2019/12/1-with-ar... from 2019/12/20 cloudflare blog post about cdnjs project: https://blog.cloudflare.com/an-update-on-cdnjs/ https://blog.cloudflare.com/an-update-on-cdnjs/

jtsiskin 5y ago
but this implies they own one of the repositories in https://cdnjs.com/libraries https://cdnjs.com/libraries?
- shoo 5y ago
  yes, that's my guess. there's 4051 of the things. or maybe there's another exploit to publish a bad version of someone else's package to npm that is already approved to have new versions mirrored by cdnjs robots ( i have no evidence that this was done in this case, but an attacker might be able to do it. there's a lot of surface area to attack in build & release pipeline of 4000+ packages )