2 ms·
But once you can make people download your malicious js code using npm, why would you then need to inject malicious js code in protobuf?
by jauco 6mo ago
But once you can make people download your malicious js code using npm, why would you then need to inject malicious js code in protobuf?
- cyanydeez 6mo agoWell, in this attack, you're using the vulenerable dev to modify their code to run a protobuf schema that's vulnerable; so then it can inject that vulnerability to the client code, and then you're exfilitrating 10's of users (the dev who ran this code isnt very popular).