How to gain code execution on hundreds of millions of people and popular apps (kibty.town)

Article summary

A security researcher discovered a vulnerability in ToDesktop, an Electron app bundler service, which allowed for remote code execution on hundreds of millions of users of popular apps such as Clickup, Cursor, and Notion Calendar. The vulnerability was caused by an insecure collection in ToDesktop's Firebase database and a post-install script in the package.json file. The researcher reported the issue to ToDesktop, which quickly fixed the vulnerability and compensated the researcher. The incident highlights the importance of security practices and responsible disclosure.

Main themes

• Security vulnerability
• Remote code execution
• Firebase security
• Electron app bundler
• Responsible disclosure
• Security practices

What commenters say

• The company's response to the vulnerability was prompt and responsible, but the incident highlights the need for improved security practices.
• The vulnerability was a result of a design flaw and not just a simple bug, and the company's claims of ensuring it won't happen again are overly confident.
• Annual pen tests and security audits are not enough to prevent similar vulnerabilities, and a more fundamental restructuring of the engineering design process is needed.
• The JavaScript and TypeScript ecosystem is not inherently insecure, and similar problems exist in all programming environments.
• The company should have notified affected customers immediately after patching the vulnerability, rather than leaving it to the customers to decide whether to continue using the service.
• The use of sourcemaps and exposed package.json files with credentials is a widespread problem that needs to be addressed.
• Critical private keys should be stored on Hardware Security Modules (HSMs) to prevent compromise.
• Firing developers who make mistakes is not an effective way to improve security, and instead, companies should focus on educating and improving their engineering design process.