Hacker News Reader

Comment by chrismarlow9 | Hacker News Reader

Looks like a bunch of re worded copies of existing CVE and a few new lower severity things. I only call them low sev because they seem to require the user to do things that are already inherently dangerous. Just my 2 cents from a quick scan.

Edit:

To be clear still interesting finds. I think with some chaining some of them might be more severe. Like the ovpn one and windows potentially registering vpn app as default open or some protocol opener for a url location like openvpn:// in an I frame and some clever social engineering. Just a random thought

View on HN

Yea, that's what's confusing. some of these are like lower level slop but some are like genuine criticals.

Floci, libssh2, c-ares, FFmpeg, and the PHP one are all LEGIT./

The Ghidra one for example, not so much. I cant help but wonder if this was halfway completed research folder and they just published it as is

I wonder if LLMs can tell the difference. Maybe it's like back in the day when you had to add "+good -bad" because otherwise it wouldn't know you wanted it to be good.

PHP one is at best a moderate-level bug in SOAP client which I don't see any realistic way to exploit (the whole convoluted setup in the POC assumes PHP execution access, which begs the question why bother if you already can execute arbitrary code?) - does not look like "genuine critical" at all.

Critical is an overstatement but it userland PHP execution does not equate to native process control. There are many situations where an attacker may have constrained PHP execution, gadget execution, template or plugin execution, deserialization reachability, or a sandboxed context, but not arbitrary native code execution or arbitrary memory write. Definitely impactful

Security-wise, there's no such thing as constrained PHP execution, at least with the standard PHP engine. The surface is too wide. You still have OS constraints of the user and capabilities and such, but beyond that if you can run PHP code, you can run anything.

Reply on news.ycombinator.com