Hacker News Reader

Hacker News

Comment by alfiedotwtf | Hacker News Reader

Full thread

alfiedotwtf

> Wait for the cdnjs library update server to process the crafted .tgz file.

I'm a bit confused... how did they get their updates pushed to a repo they didn't control?

View on HN

cdnjs will mirror any npm package

They didn't update any part of cdnjs itself. Instead, they triggered cdnjs on their package.

Do they? Their website https://cdnjs.com/libraries says "Couldn't find the library you're looking for? You can make a request to have it added on our GitHub repository."

Amusingly you can see the "hey-sven" library they added to test the fix: https://github.com/cdnjs/packages/pull/695

If you download the tarball directly, https://registry.npmjs.org/hey-sven/-/hey-sven-1.0.2.tgz, then tar -ztvf hey-sven-1.0.2.tgz, you can see

-rw-r--r-- 0 ryotak staff 204 Jun 2 16:21 package/package.json

-rw-r--r-- 0 ryotak wheel 10 Jun 2 16:21 ../../../../../../../../../../tmp/ryotak

-rw-r--r-- 0 ryotak wheel 10 Jun 2 16:22 ../../../../../../../../../../tmp/ryotak.sh

both which just have the contents "Retesting"

I'm just trying to find the root cause. I see that is PR is merged by a contributor "xtuc". Root question is that why was this PR merged? Apart from reading/writing to other files in the build pipeline instance (which is a really good catch), primary problem I see here is that anyone is able to deploy any arbitrary code/javascript to serve it from cdnjs. Just send a PR, then some contributor will merge it without checking the release package content. Don't you think that is open to a lot of issues?

Ah. Nice.

Just to clarify, we won't just mirror any npm package. We have a set list of git repos and npm packages that we pull from, and adding a new one requires a PR to our packages repo which a human must review.

Okay, then how was OP able to push that symlink library. Dis he use an already approved library or submitted a new one.

Because if he did that symlink should at least raised some eyebrows at least

echoing lalaland's comment, this diagram may give context about how changes to js libraries (incl hostile payloads, as in this example) flow through cdnjs: https://blog.cloudflare.com/content/images/2019/12/1-with-ar...

from 2019/12/20 cloudflare blog post about cdnjs project: https://blog.cloudflare.com/an-update-on-cdnjs/

but this implies they own one of the repositories in https://cdnjs.com/libraries?

yes, that's my guess. there's 4051 of the things.

or maybe there's another exploit to publish a bad version of someone else's package to npm that is already approved to have new versions mirrored by cdnjs robots ( i have no evidence that this was done in this case, but an attacker might be able to do it. there's a lot of surface area to attack in build & release pipeline of 4000+ packages )

Reply on news.ycombinator.com