4 ms·
How does the attacker supply a malicious schema? Can that be turned off? It doesn't seem like a normal thing to do.
by skybrian 6mo ago
How does the attacker supply a malicious schema? Can that be turned off? It doesn't seem like a normal thing to do.
- cyanydeez 6mo agoprobably via normal npm injection server side.
- jauco 6mo agoBut once you can make people download your malicious js code using npm, why would you then need to inject malicious js code in protobuf?
- cyanydeez 6mo agoWell, in this attack, you're using the vulenerable dev to modify their code to run a protobuf schema that's vulnerable; so then it can inject that vulnerability to the client code, and then you're exfilitrating 10's of users (the dev who ran this code isnt very popular).
- radicality 6mo agoI think something like this: Imagine a tool for querying remote grpc endpoints - you would point at some endpoint to query it / explore it, and the tool would request the proto schema files from a potentially untrusted source - something you would not expect to be that unsafe and trigger an rce.