9 ms·

It isn't about the commonality of the bug, but the level of access it gets you on the type or massive scale of the target. This bug you your blog? Who cares. Th

It isn't about the commonality of the bug, but the level of access it gets you on the type or massive scale of the target. This bug you your blog? Who cares. This bug on Discord or AWS? Much more attractive and lucrative.

mpeg 9mo ago
Yes, but this is not a particularly high access level bug. Depending on the target, it's possible that the most damage you could do with this bug is a phishing attack where the user is presented a fake sign-in form (on a sketchy url) I think $4k is a fair amount, I've done hackerone bounties too and we got less than that years ago for a twitter reflected xss
- rvnx 9mo ago
  Why would that be the maximum damage ? This XSS is particularly dangerous because you are running your script on the same domain where the user is logged-in so you can pretty much do anything you want under his session. In addition this is widespread. It's golden for any attacker.
  - 0x3f 9mo ago
    Because modern cookie directives and browser configs neuter a lot of the worst XSS outcomes/easiest exploit paths. I would expect all the big sites to be setting them, though I guess you never know.
    - rvnx 9mo ago
      I would not be that confident as you can see: on their first example, they show Discord and the XSS code is directly executed on Discord.com under the logged-in account (some people actually use web version of Discord to chat, or sign-in on the website for whatever reason). If you have a high-value target, it is a great opportunity to use such exploits, even for single shots (it would likely not be detected anyway since it's a drop in the ocean of requests). Spreading it on the whole internet is not a good strategy, but for 4000 USD, being able to target few users is a great value. Besides XSS, phishing has its own opportunity. Example: Coinbase is affected too though on the docs subdomain and there are 2-step, so you cannot do transactions directly but if you just replace the content with a "Sign-in to Coinbase / Follow this documentation procedure / Download update", this can get very very profitable. Someone would pay 4000 USD to receive 500'000 USD back in stolen bitcoins). Still, purely with executing things under the user sessions there are interesting things to do.
      - tptacek 9mo ago
        Again, here you have not so much sold a vulnerability as you have planned a heist. I agree, preemptively: you can get a lot of money from a well-executed heist!
        rvnx 9mo ago
        Do you want to execute actions as logged-in user on high-value website XXX ? If yes -> very useful
        tptacek 9mo ago
        Nobody is disputing that a wide variety of vulnerabilities are "useful", only that there's no market for most of them. I'd still urgently fix an XSS.
        rvnx 9mo ago
        There is a market outside Zerodium, it's Telegram. Finding a buyer takes time and trust, but it has definitively higher value than 4k USD because of its real-world impact, no matter if it is technically lower on the CVSS scores.
        tptacek 9mo ago
        Really? Tell me a story about someone selling an XSS vulnerability on Telegram. ("The CVSS chart"?) Moments later Why do people keep bringing up "Zerodium" as if it's a thing?
        rvnx 9mo ago
        I understand your perspective about the technical value of an exploit, but I disagree with the concept that technical value = market value. There are unorganized buyers who may be interested if they see potential to weaponize it. In reality, if you want to maximize revenue, yes, you need to organize your own heist (if that's what you meant)
    - GoblinSlayer 9mo ago
      AIU this feature is SSS, not XSS, so XSS protections don't apply.
0x3f 9mo ago
How would you make money from this? Most likely via phishing. Not exactly a zero-click RCE.
- tptacek 9mo ago
  What happens in all these discussions is that we stealthily transition from "selling a vulnerability" to "planning a heist", and you can tell yourself any kind of story about planning a heist.

mpeg 9mo ago

Yes, but this is not a particularly high access level bug. Depending on the target, it's possible that the most damage you could do with this bug is a phishing attack where the user is presented a fake sign-in form (on a sketchy url) I think $4k is a fair amount, I've done hackerone bounties too and we got less than that years ago for a twitter reflected xss

rvnx 9mo ago
Why would that be the maximum damage ? This XSS is particularly dangerous because you are running your script on the same domain where the user is logged-in so you can pretty much do anything you want under his session. In addition this is widespread. It's golden for any attacker.
- 0x3f 9mo ago
  Because modern cookie directives and browser configs neuter a lot of the worst XSS outcomes/easiest exploit paths. I would expect all the big sites to be setting them, though I guess you never know.
  - rvnx 9mo ago
    I would not be that confident as you can see: on their first example, they show Discord and the XSS code is directly executed on Discord.com under the logged-in account (some people actually use web version of Discord to chat, or sign-in on the website for whatever reason). If you have a high-value target, it is a great opportunity to use such exploits, even for single shots (it would likely not be detected anyway since it's a drop in the ocean of requests). Spreading it on the whole internet is not a good strategy, but for 4000 USD, being able to target few users is a great value. Besides XSS, phishing has its own opportunity. Example: Coinbase is affected too though on the docs subdomain and there are 2-step, so you cannot do transactions directly but if you just replace the content with a "Sign-in to Coinbase / Follow this documentation procedure / Download update", this can get very very profitable. Someone would pay 4000 USD to receive 500'000 USD back in stolen bitcoins). Still, purely with executing things under the user sessions there are interesting things to do.
    - tptacek 9mo ago
      Again, here you have not so much sold a vulnerability as you have planned a heist. I agree, preemptively: you can get a lot of money from a well-executed heist!
      - rvnx 9mo ago
        Do you want to execute actions as logged-in user on high-value website XXX ? If yes -> very useful
        tptacek 9mo ago
        Nobody is disputing that a wide variety of vulnerabilities are "useful", only that there's no market for most of them. I'd still urgently fix an XSS.
        rvnx 9mo ago
        There is a market outside Zerodium, it's Telegram. Finding a buyer takes time and trust, but it has definitively higher value than 4k USD because of its real-world impact, no matter if it is technically lower on the CVSS scores.
        tptacek 9mo ago
        Really? Tell me a story about someone selling an XSS vulnerability on Telegram. ("The CVSS chart"?) Moments later Why do people keep bringing up "Zerodium" as if it's a thing?
        rvnx 9mo ago
        I understand your perspective about the technical value of an exploit, but I disagree with the concept that technical value = market value. There are unorganized buyers who may be interested if they see potential to weaponize it. In reality, if you want to maximize revenue, yes, you need to organize your own heist (if that's what you meant)
  - GoblinSlayer 9mo ago
    AIU this feature is SSS, not XSS, so XSS protections don't apply.

0x3f 9mo ago

How would you make money from this? Most likely via phishing. Not exactly a zero-click RCE.

tptacek 9mo ago
What happens in all these discussions is that we stealthily transition from "selling a vulnerability" to "planning a heist", and you can tell yourself any kind of story about planning a heist.