4 ms·
Does "To gain access, the models identified and exploited a zero-day vulnerability (which we’ve now responsibly disclosed to the vendor) in the package registry
by Animats 3mo ago
Does "To gain access, the models identified and exploited a zero-day vulnerability (which we’ve now responsibly disclosed to the vendor) in the package registry cache proxy" just mean somebody had an open redirect? Those are still common.[1]
[1] https://sitetruth.com/reports/phishes.html https://sitetruth.com/reports/phishes.html
- simonw 3mo agoI expect it must have been more than just an open redirect if it let the models then go on to execute a bunch of vulnerabilities against Hugging Face.
- Animats 3mo agoIf it lets you do an arbitrary HTTP GET on a URL sent as a parameter to the main URL, you've escaped the sandbox rules.
- simonw 3mo agoHow do you then use GET requests to create a malicious dataset package and publish that to Hugging Face in order to exploit their package building infrastructure?
- joshka 3mo agoThere's no reason to think that a tool that can find an 0-day in a repo cache can't work out how to make that host send a post request rather than a get request once it has its keys and is able to get it to make arbitrary web calls.
- simonw 3mo agoIf the vulnerability is purely an open redirect that doesn't work for me. Clearly there was a hole in the software but I don't think open redirect is the likely initial problem. Hopefully we will find out for sure in a few days.
- tptacek 3mo agoYou convert GETs into arbitrary requests through some other pivot. I'm not saying that's what happened but this is bog-standard SSRF pentesting, so I'd expect models to be good at it.
- nickpsecurity 3mo agoI'll add that, because they mostly parrot and learn from pretraining data, they'll do any combination of what was commonly written about in articles, books, and videos. The more they're already used, the more likely they'll use the attack vector or combo.
- deleted 3mo ago[deleted]
- joshka 3mo agoI wonder if it was this bug fixed july 14 in sonatype: https://support.sonatype.com/hc/en-us/articles/53165019641363-CVE-2026-14646-Nexus-Repository-3-SSRF-via-HTTP-Redirect-2026-07-14 https://support.sonatype.com/hc/en-us/articles/5316501964136... pure speculation here - no non public info
- simonw 3mo agoI had a look at that one and several other Nexus Repository issues that share the July 14th date. I don't think they're it, for two reasons: Firstly, they all credit named individuals who don't seem to have a relationship with OpenAI - this one credits e0x1337 for example and https://hackerone.com/e0x1337?type=user https://hackerone.com/e0x1337?type=user links to https://www.linkedin.com/in/aimanharith https://www.linkedin.com/in/aimanharith Secondly, the 14th of July feels too early. HF reported the incident on the 16th and OpenAI only responded in the 21st. These issues are all patched, so they should have been reported days or weeks before the 14th.
- joshka 3mo agoThe other suspicion I had was jfrog artifactory (you mentioned OpenAI use it in a blog post in Jan). I accidentally conflated that with Nexus 14 july CVE. I think that's probably more likely. I suspect it may be possible to throw a local model (same as hf did :D) at jfrog and find the exact mechanism in a small amount of hours.
- kibibu 3mo ago> the models identified and exploited a zero-day vulnerability This use of language is very hard to reconcile with the "AI is just a tool" rhetoric that many use. Did the models do this, or did humans at OpenAI do this using the models?