Imagine just one link in a tweet, support ticket, or email: https://discord.com/_mintlify/static/evil/exploit.svg. If you click it, JavaScript runs on the discord.com origin.

Here's what could happen:

- Your Discord session cookies and token could be stolen, leading to a complete account takeover.

- read/write your developer applications & webhooks, allowing them to add or modify bots, reset secrets, and push malicious updates to millions.

- access any Discord API endpoint as you, meaning they could join or delete servers, DM friends, or even buy Nitro with your saved payment info.

- maybe even harvest OAuth tokens from sites that use "Login with Disord."

Given the potential damage, the $4,000 bounty feels like a slap in the face.

edit: just noticed how HN just turned this into a clickable link - this makes it even scarier!

If I recall last week Mintlify wrote a blog post showcasing their impressive(ly complicated) caching architecture. Pretending like they were doing real engineering, when it turns out nobody there seems to know what they're doing, but they've managed to convince some big names to use them.

Man, it's like everything I hate about modern tech. Good job Eva for finding this one. Starting to think that every AI startup or company that is heavily using gen-ai for coding is probably extremely vulnerable to the simplest of attacks. Might be a way to make some extra spending money lol.

This is very sad because SVGs often have way smaller file size, and obviously look much better at various scales. If only there was a widely used vector format that does not have any script support and can be easily shared.

  38 days after @hackermondev's disclosure, our automated OSINT harvester pulled 121 IOCs from OpenPhish/OTX:           
                                                                                                                        
  - 101 URLs for discord.flawing.top/blog/* (mimicking Discord's documentation structure)                               
  - 20 URLs for openopenbox301.vercel.app (phishing hosted ON Vercel)                                                   
                                                                                                                        
  The attackers read the same disclosures we do. They just build infrastructure instead of writing reports.             
                                                                                                                        
  Evidence (queryable):                                                                                                 
  curl "https://analytics.dugganusa.com/api/v1/search?q=discord.flawing.top"                                            
                                                                                                                        
  Full writeup with IOCs: https://www.dugganusa.com/post/mintlify-xss-downstream-exploitation-captured                  
                                                                                                                        
  STIX feed (free): https://analytics.dugganusa.com/api/v1/stix-feed

I've never heard an XSS vulnerability described as a supply-chain attack before though, usually that one is reserved for package managers malicious scripts or companies putting backdoors in hardware.

1. content security policies should always be used to prevent such scripts (here they would prevent execution of scripts from the SVG)

2. The JavaScript ecosystem should be making ` --disallow-code-generation-from-strings` a default recommendation when running NodeJS on the server.

Vercel (and other nodejs as a service providers) should warn customers that don't use CSP and `--disallow-code-generation-from-strings` that their settings should be improved.

There are a bunch of other NodeJS flags that maybe you should look into too: https://sgued.fr/blog/react-rce/#node-js-mitigations

This is also why an `app.` or even better `tenant.` subdomain is always a good idea; it limits the blast radius of mistakes like this.

Mintlify security is the worse I have even encountered in a modern SaaS company.

They will leak your data, code, assets, etc. They will know they did this. You will tell them, they will acknowledge that they knew it happened, and didn't tell you.

Your docs site will go down, and you will need to page their engineers to tell them its down. This will be a surprise to them.

Found by a 16 year old, what a legend.

"I'd rather hire a junior dev who knows the latest version of NextJS than a senior dev who is experienced with an earlier version."

This would be a forgivable remark, except the recruiter was aware of the shortsightedness, and likely attempted to coach the hiring manager...

Why do you need AI for this? Aren't there tons of packages which do very similar things without AI?

Kinda why I built ReallySimpleDocs [1]. Add Pages CMS [2] to it and you're set.

[1]: https://reallysimpledocs.com/

[2]: https://pagescms.org

    if extension == .svg
       set-header Content-Security-Policy: script-src 'none'
    end

I suspect Coinbase and others already use CSP.

https://en.wikipedia.org/wiki/Content_Security_Policy

ALSO as someone who maintains a file upload pipeline I run every SVG through a sanitizer... Tools like DOMPurify remove scripts and enforce a safe subset of the spec... I even go as far as rasterizing user uploaded vectors to PNG when possible

HOWEVER the bigger issue is mental... Most folks treat SVG like a dumb image when browsers treat it like executable content... Until the platform changes that expectation there will always be an attack surface

Unfortunately a competitive rate agreed to in advance with a company before we do any pentesting is the only way we have ever been able to get paid fairly for this sort of work. Finding bugs in the wild as this researcher did often gets wildly underpaid relative to the potential impact of the bug, if they pay or take it seriously at all.

These companies should be ashamed paying out so little for this, and it is only a matter of time before they insult the wrong researcher who decides to pursue paths to maximum profit, or maximum damage, with a vuln like this.

I have a friend who at one point had five monitors and 2 computers (actually it might be 3) on his desk and maybe he’s the one doing it right. He keeps his personal stuff and his programming/work stuff completely separate.

Or maybe we need a new image format, "SVG without scripts and CSS".

Oh yikes. I did not know.

simultaneously there are many opportunities throughout to harden one's app to avoid similar exploits.

- that bug bounty was insufficient (Fidelity?!?!)

Tho what i find mostly funny bout it is how many people are complaining about the 4k$.

I mean sure the potential "damage" could have been alot higher, tho at the same time there was no contract in place or , at least as far as i understood, a clear bug bounty targeted. This was a, even if well done, random checking of XHR/Requests to see if anything vulnerable can be found - searching for kinda file exposure / xss / RFI/LFI. So everything paid (and especially since this is a mintlify bug not an actual discord bug) is just a nice net gain.

Also ill just drop here : ask yourself, are you searching for such vulns just for money or to make the net a safer place for everyone. Sure getting some bucks for the work is nice, but i personally just hope stuff gets fixed on report.

The OP site says that .svg files can only run scripts if they are directly opened, not via <img> tags.

So how does the attack work?

I have this feeling with almost all web tools I am required to use nowadays.

No trust.

Ok, you got "https://discord.com/_mintlify/_static/hackerone-a00f3c6c/lma..." to send a controlled payload

But regular users will never hit "https://discord.com/_mintlify/_static/hackerone-a00f3c6c/lma...", so they will never execute your script

I fail to understand how this can be exploited, by whom and in what conditions