Hacker News Reader

> ... insufficient data validation in the open-source project for YubiKey Validation Server

This brought clarity to the headline for me. Hope it helps others before clicking.

Much better - and default config is a denial of service impact issue (not remote code or replay).

I'm not sure I trust the "it's SQL injection but you can only use it to stuff bad records into the database" summary here. SQL is usually an easy thing to pivot from.

The way I read the advisory is: (1) The most harmful vulnerability represented anywhere in this advisory is SQL injection. (2) The sync endpoint allows a full SQL injection, but the sync endpoint is normally IP-restricted and has an empty allow list in the default configuration, which can mitigate the exposure. (3) The verify endpoint does not allow a full SQL injection, but allows overly long values to be passed through to SQL.

The first paragraph in “Technical details” mixes (1) and (3) confusingly, and should have had a paragraph break before the sentence beginning “Verify” (or been rewritten).

A quick glance at the patchset suggests this is right (the verification code looks to have been made stricter in the verify endpoint, but added in the sync endpoint), but I didn't dig deeper than that.

[edited slightly for wording]

Thanks! This is super helpful.

Reply on news.ycombinator.com