3 ms·

Anyone have background on what a "third party finding" is? Are they talking about dependencies? Because, to me, this specific bug is both a first AND third part

Anyone have background on what a "third party finding" is? Are they talking about dependencies? Because, to me, this specific bug is both a first AND third party issue (e.g. GitLab not pre-verifying before calling ExifTool).

magicalhippo 5y ago
> Because, to me, this specific bug is both a first AND third party issue Seems GitLab agreed on that one, they registered two CVEs: ExifTool https://nvd.nist.gov/vuln/detail/CVE-2021-22204 https://nvd.nist.gov/vuln/detail/CVE-2021-22204 GitLab https://nvd.nist.gov/vuln/detail/CVE-2021-22205 https://nvd.nist.gov/vuln/detail/CVE-2021-22205
PragmaticPulp 5y ago
> Anyone have background on what a "third party finding" is? Are they talking about dependencies? Yes. I've had some experience with bug bounty programs. The situation with vulnerabilities in dependencies is complicated. On one hand you want to incentivize researchers to find vulnerabilities in your dependencies, which likely don't have their own bug bounty programs. On the other hand, you run into situations where researchers discover a bug in a 3rd-party library and, instead of reporting it ASAP, they keep it secret as long as possible while they build up an arsenal of bug bounty exploits to report to multiple companies that use the library. This is a weird disincentive to fix the underlying bug quickly because the researchers know they only have so much time to exploit it in bug bounty programs before one of the companies fixes it upstream. We also had a problem where amateurs would spam our bug bounty program any time a CVE came out for one of our dependencies, even if they couldn't exploit it. It was relatively easy to close these bug reports because they couldn't provide a proof of concept exploit, but it still wasted a lot of time arguing with them, especially when they'd try to blackmail us on social media for not paying them out (for a bug that didn't exist in our product). I do not miss my days of dealing with bug bounty programs. Met a few great researchers, but most of the (attempted) participants were trying harder to exploit the bug bounty program than find exploits in our code.
- pm90 5y ago
  Fascinating. I would love to read more about your experience if you have a blog.

magicalhippo 5y ago

> Because, to me, this specific bug is both a first AND third party issue Seems GitLab agreed on that one, they registered two CVEs: ExifTool https://nvd.nist.gov/vuln/detail/CVE-2021-22204 https://nvd.nist.gov/vuln/detail/CVE-2021-22204 GitLab https://nvd.nist.gov/vuln/detail/CVE-2021-22205 https://nvd.nist.gov/vuln/detail/CVE-2021-22205

PragmaticPulp 5y ago

> Anyone have background on what a "third party finding" is? Are they talking about dependencies? Yes. I've had some experience with bug bounty programs. The situation with vulnerabilities in dependencies is complicated. On one hand you want to incentivize researchers to find vulnerabilities in your dependencies, which likely don't have their own bug bounty programs. On the other hand, you run into situations where researchers discover a bug in a 3rd-party library and, instead of reporting it ASAP, they keep it secret as long as possible while they build up an arsenal of bug bounty exploits to report to multiple companies that use the library. This is a weird disincentive to fix the underlying bug quickly because the researchers know they only have so much time to exploit it in bug bounty programs before one of the companies fixes it upstream. We also had a problem where amateurs would spam our bug bounty program any time a CVE came out for one of our dependencies, even if they couldn't exploit it. It was relatively easy to close these bug reports because they couldn't provide a proof of concept exploit, but it still wasted a lot of time arguing with them, especially when they'd try to blackmail us on social media for not paying them out (for a bug that didn't exist in our product). I do not miss my days of dealing with bug bounty programs. Met a few great researchers, but most of the (attempted) participants were trying harder to exploit the bug bounty program than find exploits in our code.

pm90 5y ago
Fascinating. I would love to read more about your experience if you have a blog.