7 ms·

>the $4,000 bounty feels like a slap in the face. And serves a reminder crime does pay. In the black market, it would have been worth a bit more.

by snvzz 10mo ago

tptacek 10mo ago
No it would not have been.
- tuhgdetzhh 10mo ago
  Could you elaborate on why not?
  - arcwhite 10mo ago
    There's generally no grey market for XSS vulns. The people buying operationalized exploits generally want things that they can aim very specifically to achieve an outcome against a particular target, without that target knowing about it, and operationalized XSS vulns seldom have that nature. Your other potential buyers are malware distributors and scammers, who usually want a vuln that has some staying power (e.g. years of exploitability). This one is pretty clearly time-limited once it becomes apparent.
  - tptacek 10mo ago
    What 'arcwhite said (sorry, I got dragged into a call). 1. The exploits (not vulnerabilities; that's mostly not a thing) that command grey/black market value all have half-lives. 2. Those exploits all fit into existing business processes; if you're imagining a new business, one that isn't actively running right now as we speak (such as you'd have to do to fit any XSS in a specific service), you're not selling an exploit; you're planning a heist. 3. The high-dollar grey market services traffic exclusively in RCE (specifically: reliable RCE exploits, overwhelmingly in mainstream clientside platforms, with sharp dropoffs in valuation as you go from e.g. Chrome to the next most popular browser). 4. Most of the money made in high-ticket exploit sales apparently (according to people who actually do this work) comes on the backend, from tranched maintenance fees.
- Lionga 10mo ago
  It would have been. Ten times the amount at least.
  - mpeg 10mo ago
    For a reflected XSS? Tell me who is paying that much for such a relatively common bug... To elaborate, to exploit this you have to convince your target to open a specially crafted link which would look very suspect. The most realistic way to exploit would be to send a shortened link and hope they click on it, that they are logged into discord.com when they do (most people use the app), that there are no other security measures (httponly cookies) etc No real way to use this to compromise a large amount of users without more complex means
    - varenc 10mo ago
      Also the XSS exploit would have been dead in the water for any sites using CSP headers. Coinbase certainly uses CSP. With this in place an XSS vuln can't inject arbitrary JS.
    - PenguinCoder 10mo ago
      It isn't about the commonality of the bug, but the level of access it gets you on the type or massive scale of the target. This bug you your blog? Who cares. This bug on Discord or AWS? Much more attractive and lucrative.
      - mpeg 10mo ago
        Yes, but this is not a particularly high access level bug. Depending on the target, it's possible that the most damage you could do with this bug is a phishing attack where the user is presented a fake sign-in form (on a sketchy url) I think $4k is a fair amount, I've done hackerone bounties too and we got less than that years ago for a twitter reflected xss
        rvnx 10mo ago
        Why would that be the maximum damage ? This XSS is particularly dangerous because you are running your script on the same domain where the user is logged-in so you can pretty much do anything you want under his session. In addition this is widespread. It's golden for any attacker.
- notnullorvoid 10mo ago
  This specific XSS vulnerability may not have been, but the linked RCE vulnerability found by their friend https://kibty.town/blog/mintlify/ https://kibty.town/blog/mintlify/ certainly would've been worth more than the $5,000 they were awarded. A vulnerability like that (or even a slightly worse XSS that allowed serving js instead of only svg) could've let them register service workers to all visiting users giving future XSS ability at any time, even after the original RCE and XSS were patched.
  - tptacek 10mo ago
    Maybe? I don't know enough about the vulnerability. Is it serverside? Then it isn't worth very much.
    - jrflowers 10mo ago
      >i quickly realised that this was the server-side serverless (lol) environment of their main documentation app, while this calls to a external api to do everything, we have the token it calls it with in the env. >alongside, we can poison the nextjs cache for everyone for any site, allowing mass xss, defacing, etc on any docs site.
      - tptacek 10mo ago
        So it's a serverside bug that basically creates a more-severe stored DOM corruption vulnerability? Yeah, that's not worth anything to any buyer of vulnerabilities that I know exists. Maybe you know ones that I don't know.
        jrflowers 10mo ago
        I can’t speak to the value of the vulnerability as I lack the universal Rolodex of Every Exploit Buyer that is apparently available (nor am I interested in debating this with somebody that admitted they didn’t know anything about the vulnerability, declared it worthless anyway, and then moved the goalposts after a core assumption about it was trivially shown to be wrong. I’m fairly certain at this point these kids could recreate the end of the movie Antitrust and there’d be a thread somewhere with tptacek posting “This isn’t that big of a deal because”). I just saw that you asked if the article about the server-side exploit was about a server-side exploit. It is. It’s right there in the post.
doctorpangloss 10mo ago
yeah, but nothing pays as much as doing free work for (checks notes) mintlify feels
imdsm 10mo ago
I was once only given $1,000 for an exploit where I could put in npm usernames and get their email addresses. Big corps don't always pay what they should.
- deleted 10mo ago
  [deleted]

>the $4,000 bounty feels like a slap in the face. And serves a reminder crime does pay. In the black market, it would have been worth a bit more.

by snvzz 10mo ago

>the $4,000 bounty feels like a slap in the face. And serves a reminder crime does pay. In the black market, it would have been worth a bit more.

tptacek 10mo ago

No it would not have been.

tuhgdetzhh 10mo ago
Could you elaborate on why not?
- arcwhite 10mo ago
  There's generally no grey market for XSS vulns. The people buying operationalized exploits generally want things that they can aim very specifically to achieve an outcome against a particular target, without that target knowing about it, and operationalized XSS vulns seldom have that nature. Your other potential buyers are malware distributors and scammers, who usually want a vuln that has some staying power (e.g. years of exploitability). This one is pretty clearly time-limited once it becomes apparent.
- tptacek 10mo ago
  What 'arcwhite said (sorry, I got dragged into a call). 1. The exploits (not vulnerabilities; that's mostly not a thing) that command grey/black market value all have half-lives. 2. Those exploits all fit into existing business processes; if you're imagining a new business, one that isn't actively running right now as we speak (such as you'd have to do to fit any XSS in a specific service), you're not selling an exploit; you're planning a heist. 3. The high-dollar grey market services traffic exclusively in RCE (specifically: reliable RCE exploits, overwhelmingly in mainstream clientside platforms, with sharp dropoffs in valuation as you go from e.g. Chrome to the next most popular browser). 4. Most of the money made in high-ticket exploit sales apparently (according to people who actually do this work) comes on the backend, from tranched maintenance fees.
Lionga 10mo ago
It would have been. Ten times the amount at least.
- mpeg 10mo ago
  For a reflected XSS? Tell me who is paying that much for such a relatively common bug... To elaborate, to exploit this you have to convince your target to open a specially crafted link which would look very suspect. The most realistic way to exploit would be to send a shortened link and hope they click on it, that they are logged into discord.com when they do (most people use the app), that there are no other security measures (httponly cookies) etc No real way to use this to compromise a large amount of users without more complex means
  - varenc 10mo ago
    Also the XSS exploit would have been dead in the water for any sites using CSP headers. Coinbase certainly uses CSP. With this in place an XSS vuln can't inject arbitrary JS.
  - PenguinCoder 10mo ago
    It isn't about the commonality of the bug, but the level of access it gets you on the type or massive scale of the target. This bug you your blog? Who cares. This bug on Discord or AWS? Much more attractive and lucrative.
    - mpeg 10mo ago
      Yes, but this is not a particularly high access level bug. Depending on the target, it's possible that the most damage you could do with this bug is a phishing attack where the user is presented a fake sign-in form (on a sketchy url) I think $4k is a fair amount, I've done hackerone bounties too and we got less than that years ago for a twitter reflected xss
      - rvnx 10mo ago
        Why would that be the maximum damage ? This XSS is particularly dangerous because you are running your script on the same domain where the user is logged-in so you can pretty much do anything you want under his session. In addition this is widespread. It's golden for any attacker.
notnullorvoid 10mo ago
This specific XSS vulnerability may not have been, but the linked RCE vulnerability found by their friend https://kibty.town/blog/mintlify/ https://kibty.town/blog/mintlify/ certainly would've been worth more than the $5,000 they were awarded. A vulnerability like that (or even a slightly worse XSS that allowed serving js instead of only svg) could've let them register service workers to all visiting users giving future XSS ability at any time, even after the original RCE and XSS were patched.
- tptacek 10mo ago
  Maybe? I don't know enough about the vulnerability. Is it serverside? Then it isn't worth very much.
  - jrflowers 10mo ago
    >i quickly realised that this was the server-side serverless (lol) environment of their main documentation app, while this calls to a external api to do everything, we have the token it calls it with in the env. >alongside, we can poison the nextjs cache for everyone for any site, allowing mass xss, defacing, etc on any docs site.
    - tptacek 10mo ago
      So it's a serverside bug that basically creates a more-severe stored DOM corruption vulnerability? Yeah, that's not worth anything to any buyer of vulnerabilities that I know exists. Maybe you know ones that I don't know.
      - jrflowers 10mo ago
        I can’t speak to the value of the vulnerability as I lack the universal Rolodex of Every Exploit Buyer that is apparently available (nor am I interested in debating this with somebody that admitted they didn’t know anything about the vulnerability, declared it worthless anyway, and then moved the goalposts after a core assumption about it was trivially shown to be wrong. I’m fairly certain at this point these kids could recreate the end of the movie Antitrust and there’d be a thread somewhere with tptacek posting “This isn’t that big of a deal because”). I just saw that you asked if the article about the server-side exploit was about a server-side exploit. It is. It’s right there in the post.

doctorpangloss 10mo ago

yeah, but nothing pays as much as doing free work for (checks notes) mintlify feels

imdsm 10mo ago

I was once only given $1,000 for an exploit where I could put in npm usernames and get their email addresses. Big corps don't always pay what they should.

deleted 10mo ago
[deleted]