42 ms·

Found this fun stack overflow post: https://stackoverflow.com/questions/49299000/what-are-the-security-implications-of-the-isevalsupported-option-in-pdf-js htt

Found this fun stack overflow post: https://stackoverflow.com/questions/49299000/what-are-the-security-implications-of-the-isevalsupported-option-in-pdf-js https://stackoverflow.com/questions/49299000/what-are-the-se...

pixl97 2y ago
That poor incorrect post in that thread from 2018.
- naberhausj 2y ago
  Like I asked the other person in this thread, what's wrong with that answer? Not only does it correctly identify the attack vector of this CVE, but I think his advice on how to mitigate it is sound. Is there something I'm missing? The only flaw I see is that it doesn't consider the implications of using PDF.js in Electron.
- deleted 2y ago
  [deleted]
- tgsovlerkhgsel 2y ago
  It's not even incorrect. The option isn't supposed to allow XSS-by-design (which the original requester was worried about), the possibility of a vulnerability is mentioned, the impact of a vulnerability is correctly described (XSS not RCE or similar), and mitigations that would effectively limit the impact of such a vulnerability are presented (separate origin).
daghamm 2y ago
Accepted answer: "Potentially, there is a tiny possibility... Keep in mind, it's a web application, and worse it can do is XSS attack" One sad thing about security is that everyone and their uncle is a security expert.
- baobabKoodaa 2y ago
  What is wrong with that accepted answer?
  - daghamm 2y ago
    For one, every security disaster starts with people listening to a random guy claiming that the probability of something being exploitable is virtually zero :) People who have been in this game more than six months would never making such a claim. And only XSS? What does that mean in the context of the page, or an electron app? How can this guy know "just an XSS" is not catastrophic?
    - baobabKoodaa 2y ago
      I think you're being unnecessarily harsh. First off, are we not supposed to have "random guys" writing stuff on Stack Overflow and Wikipedia? Because that's kind of how those websites work: they rely on "random guys" to do all of the writing, rather than relying on credentialed experts only. I sure think Stack Overflow and Wikipedia are very useful resources despite having "random guys" do all the writing. Secondly, you attack the random guy for... correctly identifying that "the worst it can do is an XSS attack". This is very useful and accurate information. Information like this is typically absent from all kinds of vulnerability disclosures. When you read on the news that something something has a vulnerability, they typically they don't give you the practically useful bit of information, like what is the practical scope. Is it a 0-click RCE or is it a XSS inside a web app? They don't tell you. Except this random guy, who accurately identifies this information. > How can this guy know "just an XSS" is not catastrophic? "Just an XSS" is the correct description of the severity here.
      - cxr 2y ago
        > I think you're being unnecessarily harsh. More like dogpiling and coattail-riding of the current in-focus topic. Both comments smack of smug know-betterness but are accompanied only by vague remarks and no real claims that might be subjected to scrutiny. It's almost like dogwhistling for karma.

pixl97 2y ago

That poor incorrect post in that thread from 2018.

naberhausj 2y ago
Like I asked the other person in this thread, what's wrong with that answer? Not only does it correctly identify the attack vector of this CVE, but I think his advice on how to mitigate it is sound. Is there something I'm missing? The only flaw I see is that it doesn't consider the implications of using PDF.js in Electron.
deleted 2y ago
[deleted]
tgsovlerkhgsel 2y ago
It's not even incorrect. The option isn't supposed to allow XSS-by-design (which the original requester was worried about), the possibility of a vulnerability is mentioned, the impact of a vulnerability is correctly described (XSS not RCE or similar), and mitigations that would effectively limit the impact of such a vulnerability are presented (separate origin).

daghamm 2y ago

Accepted answer: "Potentially, there is a tiny possibility... Keep in mind, it's a web application, and worse it can do is XSS attack" One sad thing about security is that everyone and their uncle is a security expert.

baobabKoodaa 2y ago
What is wrong with that accepted answer?
- daghamm 2y ago
  For one, every security disaster starts with people listening to a random guy claiming that the probability of something being exploitable is virtually zero :) People who have been in this game more than six months would never making such a claim. And only XSS? What does that mean in the context of the page, or an electron app? How can this guy know "just an XSS" is not catastrophic?
  - baobabKoodaa 2y ago
    I think you're being unnecessarily harsh. First off, are we not supposed to have "random guys" writing stuff on Stack Overflow and Wikipedia? Because that's kind of how those websites work: they rely on "random guys" to do all of the writing, rather than relying on credentialed experts only. I sure think Stack Overflow and Wikipedia are very useful resources despite having "random guys" do all the writing. Secondly, you attack the random guy for... correctly identifying that "the worst it can do is an XSS attack". This is very useful and accurate information. Information like this is typically absent from all kinds of vulnerability disclosures. When you read on the news that something something has a vulnerability, they typically they don't give you the practically useful bit of information, like what is the practical scope. Is it a 0-click RCE or is it a XSS inside a web app? They don't tell you. Except this random guy, who accurately identifies this information. > How can this guy know "just an XSS" is not catastrophic? "Just an XSS" is the correct description of the severity here.
    - cxr 2y ago
      > I think you're being unnecessarily harsh. More like dogpiling and coattail-riding of the current in-focus topic. Both comments smack of smug know-betterness but are accompanied only by vague remarks and no real claims that might be subjected to scrutiny. It's almost like dogwhistling for karma.