4 ms·

Great article! So, let me see if I get this straight... cdnjs is a CDN for javascript libraries. cdnjs has a "library update server", in which an "auto-update

Great article! So, let me see if I get this straight... cdnjs is a CDN for javascript libraries. cdnjs has a "library update server", in which an "auto-update script" runs periodically to update the libraries that the CDN offers. If it finds a new version of a library, it downloads the files from the library's git repository, and it publishes them on the CDN. There can be symlinks in git repositories, but the "auto-update script" doesn't handle them correctly. And that's the core of the vulnerability. If you own the git repository of a library published by cdnjs, you could add a symlink to the git repository. The symlink could point to a file that you want to access on the cdnjs "library update server". Then, as soon as the "auto-update script" runs, the file's contents will be public to everyone on the CDN. But how would you manage to create a malicious library and have it approved by cdnjs? That's the part of the exploit that sounds the hardest, and I don't see a reasonable way to go about it.

MattIPv4 5y ago
> But how would you manage to create a malicious library and have it approved by cdnjs? That's the part of the exploit that sounds the hardest, and I don't see a reasonable way to go about it. 1. Hijack an existing library to publish the malicious version 2. or, Have us approve what looks like a legitimate library, which later publishes a malicious version
- teddyh 5y ago
  > 1. Hijack an existing library Hijack or buy outright an existing library. IIRC, there have been many such instances where existing projects have been sold for large sums to questionable parties.
NotEvil 5y ago
As I understand it. Every library in npm registry (they library you can install using npm) are also automatically approved ( which sounds reasonable you don't want to approve every library by hand). And that's what the author exploits by registering a library that have a symlink in it. Which then got excuted.

MattIPv4 5y ago

> But how would you manage to create a malicious library and have it approved by cdnjs? That's the part of the exploit that sounds the hardest, and I don't see a reasonable way to go about it. 1. Hijack an existing library to publish the malicious version 2. or, Have us approve what looks like a legitimate library, which later publishes a malicious version

teddyh 5y ago
> 1. Hijack an existing library Hijack or buy outright an existing library. IIRC, there have been many such instances where existing projects have been sold for large sums to questionable parties.

NotEvil 5y ago

As I understand it. Every library in npm registry (they library you can install using npm) are also automatically approved ( which sounds reasonable you don't want to approve every library by hand). And that's what the author exploits by registering a library that have a symlink in it. Which then got excuted.