Unlurker|Replay|About
Evolving Threat: http2shell is an RCE in Node, Python, and more (nitter.click)
I had some fun playing with this on Wednesday. After the node release, it was still about a day before the patched brotli package showed up on pypi. Very easy to reproduce the with a single httpx.get(URL) in Python, but I couldn’t figure out an ASLR bypass from that context. Crashing is easy and I (with LLM assistance) can get some read/write primitives, but no chain into getting a function pointer where I needed it. Probably needs heap manipulation, but I lost interest at that point. Really hoping we see an actual RCE PoC. Also, the open weight models can easily provide a "regression test" that would shoo away most crawlers.
•
Why are you hoping for an RCE PoC? Curiosity's sake? Or because you'd like to use it offensively? The existence/publication of such a PoC makes the world less safe.
You don't. Any real compression algorithm, including all the other standard ones, doesn't need such a thing.
•
Many compression formats support static dictionaries, and for a good reason. Short messages don't compress well. If you can bring in a context full of common header names and values, they compress a lot better, from the very first request.
The whole package manager system is a complete disaster. A huge number of dependencies are pulled in that go unused in most projects, so the number of downloads is an extremely unreliable number. I'd be surprised if more than 10% of those downloads actually use the brotli decoder.
•
Well first off I love PyPI and am greatly offended on the behalf of thew newly-formed (forming?) council to fix it, but also I don't think that applies in this case. If your server is capable of decoding brotli packets it's at risk -- you don't have to actually use that functionality regularly.
That's just the total number of times that package was downloaded, which is completely unrelated to how many servers it appears in? Same with `aiohttp`: aiohttp can be used as a client library. Sure, people should check their dependency trees, and make informed decisions.
•
Ok putting aside the "client" thing again assuming I'm just behind the times on python client-server architecture norms: What kind of vulnerability would concern you? Sure, we can't say for sure that all 4 million of the jobs who downloaded (not built-with, but downloaded to cache anew) this library yesterday are running public-facing servers. But what subset of them might be? How much would it take before it's a concern? Python feels particularly worrisome to me, as those are the kind of casually-setup servers on local dev boxes for some random little tool that are the most fertile ground for an exploit like this, where creds could be spread around in plaintext and malware could go unnoticed for a long time. And, of course, where the developers responsible probably aren't in the habit of watching the CVE list (yet...). I hope I'm not coming across as rude -- I am honestly curious!
No language is safe, not even Rust https://news.ycombinator.com/item?id=50069499 Edit: why flagged
•
> Edit: why flagged Well for one you linked a bug that didn't lead to any known vulnerabilities. (And isn't an overflow.)
 Top