news.volyx.in

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack (gist.github.com)

1167 points by hackermondev · 217 days ago · 433 comments on HN

Article summary

A 16-year-old high school student discovered a critical cross-site scripting vulnerability in Mintlify, an AI-powered documentation platform used by several major companies, including Discord, X, Vercel, and Cursor. The vulnerability allowed an attacker to inject malicious scripts into the documentation of numerous companies and steal credentials from users with a single link open. The student and their friends reported the vulnerability to Discord and Mintlify, and received a total of $11,000 in bounties. The vulnerability was patched, and the companies took steps to prevent similar issues in the future.

Main themes

  • Bug bounty programs
  • Supply chain security
  • Cross-site scripting vulnerabilities
  • Responsible disclosure
  • Cybersecurity economics
  • Vulnerability exploitation

What commenters say

  • The bug bounty payout of $4,000 from Discord is considered too low for the severity of the vulnerability and the potential damage it could have caused.
  • The discovery of the vulnerability highlights the importance of responsible disclosure and the need for companies to prioritize security and pay fair bounties to researchers.
  • Some argue that the market-clearing price of an XSS vulnerability is very low because it doesn't fit into existing business processes and is situational and time-sensitive.
  • Others believe that the payout should be based on the potential damage the vulnerability could cause, rather than its market value, to encourage responsible disclosure and prevent exploitation.
  • The vulnerability and its discovery raise questions about the effectiveness of bug bounty programs and the economics of cybersecurity, including the role of supply and demand in determining payout amounts.
  • There is disagreement about whether the payout is sufficient to incentivize researchers to disclose vulnerabilities responsibly, with some arguing that it is too low and others seeing it as a fair reward for the discovery.