Stories with Tag software vulnerability

• Unauthenticated Remote Code Execution in Erlang/OTP SSH

  permalink

  Posted: 2025-04-17 13:29:44

  Verbose tl;dr

  A critical vulnerability (CVE-2025-32433) exists in Erlang/OTP's SSH implementation, affecting versions prior to 26.2.1 and 25.3.2.6. This flaw allows unauthenticated remote attackers to execute arbitrary code on the server. Specifically, a specially crafted SSH message can trigger the vulnerability during the initial handshake, before authentication occurs, enabling complete system compromise. Users are urged to update their Erlang/OTP installations to the latest patched versions as soon as possible.

  The National Vulnerability Database entry, CVE-2025-32433, details a critical vulnerability affecting Erlang/OTP (Open Telecom Platform) versions prior to 26.1, and versions prior to 25.3.2.3 in the 25 series. This vulnerability allows for unauthenticated remote code execution, meaning an attacker can execute arbitrary code on a vulnerable system without needing any valid credentials. This is achieved by exploiting a flaw in the implementation of the SSH (Secure Shell) protocol within Erlang/OTP.

  Specifically, the vulnerability stems from improper input validation during the SSH handshake process. When an SSH client connects to an Erlang/OTP SSH server, a series of messages are exchanged to establish the connection and negotiate cryptographic parameters. The vulnerability lies in how the server handles certain messages related to key exchange algorithms. A maliciously crafted client can send a specially constructed message during this key exchange phase that bypasses the authentication checks. This allows the attacker to proceed with the connection as if they were a legitimate, authenticated user.

  Once the attacker bypasses authentication, they effectively gain control of the SSH connection. This allows them to execute commands on the server with the same privileges as the SSH service itself. The impact of successful exploitation can be severe, potentially leading to complete compromise of the affected system. An attacker could install malware, exfiltrate sensitive data, disrupt services, or gain further access to internal network resources.

  The vulnerability affects a wide range of Erlang/OTP deployments that utilize the built-in SSH server functionality. This includes various applications built on the Erlang/OTP platform, as well as systems using Erlang/OTP for distributed computing and communication.

  The recommended remediation is to upgrade to Erlang/OTP version 26.1 or 25.3.2.3, which addresses the vulnerability through improved input validation during the SSH handshake. By applying these updates, the server will correctly handle the malicious messages and prevent unauthenticated access, thus mitigating the risk of remote code execution.

  • Erlang
  • OTP
  • ssh
  • RCE
  • remote code execution
  • Unauthenticated
  • Vulnerability
  • CVE
  • CVE-2025-32433
  • Security
  • Cybersecurity
  • network security
  • software vulnerability
  • Exploit
  • NIST
  • NVD

  Summary of Comments ( 11 )
  https://news.ycombinator.com/item?id=43716526

  Verbose tl;dr

  Hacker News users discuss the severity and impact of the Erlang/OTP SSH vulnerability. Some highlight the potential for widespread exploitation given Erlang's usage in telecom infrastructure and distributed systems. Several commenters question the assigned CVSS score of 9.8, finding it surprisingly high for a vulnerability that requires non-default configuration (specifically enabling password authentication). The discussion also touches on the practical implications of the vulnerability, acknowledging that while serious, exploitation might be limited by the need for open SSH ports and enabled password logins. Others express concern about the potential for nested exploitation, as vulnerable Erlang systems might host other exploitable services. Finally, some users note the responsible disclosure and patching process.

  The Hacker News post titled "Unauthenticated Remote Code Execution in Erlang/OTP SSH" (https://news.ycombinator.com/item?id=43716526) has several comments discussing the vulnerability (CVE-2025-32433).

  Several commenters highlight the severity of the vulnerability, being an unauthenticated remote code execution flaw. One user points out the particularly dangerous combination of this being a pre-auth vulnerability and Erlang's frequent use in distributed systems, increasing the potential attack surface. They mention that distributed Erlang systems often run with minimal firewalling, making them easier targets.

  Another commenter notes that exploitation is straightforward, quoting the NIST advisory that "Successful exploitation of this vulnerability requires only sending a crafted SSH message." This emphasizes the low barrier to entry for potential attackers.

  Discussion also revolves around the practical impact. One user questions how many publicly exposed Erlang SSH servers exist, suggesting that while serious, the impact might be limited depending on the prevalence of such deployments. This prompts another commenter to mention that while direct SSH access to Erlang nodes might be less common, many systems likely use distributed Erlang for backend communication, which could be vulnerable.

  A commenter with experience in securing Erlang systems suggests that the vulnerability reinforces the importance of employing robust network security measures, like firewalls and VPNs, even within internal networks. They highlight that assuming internal networks are safe is a dangerous misconception.

  There's some discussion of the technical details. One user dives deeper into the mechanism of the vulnerability, explaining that it arises from the way the ssh_packet_set_size/1 function handles size limits before authentication, allowing malicious actors to bypass checks and execute arbitrary code.

  Finally, several commenters express concern about the vulnerability's potential to affect critical infrastructure and industrial control systems, given Erlang's presence in those sectors. One user speculates about the potential for this vulnerability to be exploited in targeted attacks.

• Hacking the Xbox 360 Hypervisor Part 2: The Bad Update Exploit

  permalink

  Posted: 2025-03-03 18:06:17

  Verbose tl;dr

  The post details an exploit targeting the Xbox 360's hypervisor, specifically through a vulnerability in the console's update process. By manipulating the order of CB/CD images on a specially crafted USB drive during a system update, the exploit triggers a buffer overflow in the hypervisor's handling of image metadata. This overflow overwrites critical data, allowing the attacker to gain code execution within the hypervisor itself, effectively bypassing the console's security mechanisms and gaining full control of the system. The post specifically focuses on the practical implementation of the exploit, describing the meticulous process of crafting the malicious update package and the challenges encountered in triggering the vulnerability reliably.

  This blog post details a sophisticated exploit leveraging a vulnerability within the Xbox 360's update process, specifically targeting the hypervisor, a critical component responsible for managing the console's hardware and software. The hypervisor, operating at a higher privilege level than the kernel, is typically impenetrable, making this exploit particularly noteworthy. The vulnerability exploited is classified as a "bad update" attack, meaning it hinges on manipulating the update mechanism itself. The author explicitly states that this isn't a "JTAG" exploit, which typically involves hardware manipulation. Instead, this approach utilizes carefully crafted data presented during the update process to induce an exploitable condition.

  The core of the exploit revolves around how the Xbox 360's hypervisor handles the loading and validation of updated code. The update process involves writing new code to flash memory. The hypervisor is responsible for verifying the integrity and authenticity of this code before execution. The exploit capitalizes on a flaw in this validation process. By meticulously structuring the update data, the author manages to bypass the hypervisor's checks, effectively injecting malicious code into the system. This manipulation is achieved by understanding the internal workings of the hypervisor's update routines and constructing specific data patterns that trigger unexpected behavior.

  The author meticulously describes the process of crafting the malicious update. They highlight the importance of understanding the hypervisor's memory layout, the structure of the update files, and the precise sequence of operations involved during the update process. The post elucidates how specific values within the update data are manipulated to cause a buffer overflow. This overflow overwrites critical areas of memory within the hypervisor's address space. By carefully controlling the overwritten data, the attacker gains control of the execution flow, redirecting it to the injected malicious code.

  The post explains that the successful execution of this exploit grants control over the hypervisor itself, the most privileged level of the Xbox 360 system. This level of access effectively bypasses all security mechanisms, enabling complete control over the console's hardware and software. While the post doesn't delve into the specific post-exploitation activities, acquiring hypervisor control allows for modifications like running unsigned code, installing custom firmware, and potentially circumventing copy protection mechanisms. The post concludes with a successful demonstration of the exploit, showcasing the resultant control over the hypervisor. This demonstration further solidifies the efficacy and severity of the discovered vulnerability.

  • xbox 360
  • Hypervisor
  • hacking
  • Exploit
  • Security
  • Reverse Engineering
  • Firmware
  • update
  • Modding
  • Console Hacking
  • software vulnerability
  • Bad Update

  Summary of Comments ( 87 )
  https://news.ycombinator.com/item?id=43244739

  Verbose tl;dr

  HN commenters discuss the technical details of the Xbox 360 hypervisor exploit, praising the author's clear explanation of a complex topic. Several commenters dive into specific aspects like the chosen attack vector, the role of timing, and the intricacies of DMA manipulation. Some express nostalgia for the era of console hacking and the ingenuity involved. Others draw parallels to modern security challenges, highlighting the constant cat-and-mouse game between security researchers and exploit developers. A few commenters also touch upon the legal and ethical considerations of such exploits.

  The Hacker News post "Hacking the Xbox 360 Hypervisor Part 2: The Bad Update Exploit" (https://news.ycombinator.com/item?id=43244739) has a moderate number of comments, discussing various aspects of the exploit detailed in the linked blog post.

  Several commenters express admiration for the ingenuity and complexity of the exploit. One user describes the work as "absolutely brilliant" and highlights the cleverness of exploiting a race condition during the update process. Another commenter notes the depth of understanding of the system required to pull this off, emphasizing the impressive reverse engineering effort involved.

  A significant thread discusses the legal and ethical implications of such exploits. One user raises concerns about the potential misuse of these vulnerabilities for piracy and cheating, while another argues that responsible disclosure allows manufacturers to patch vulnerabilities and improve security for everyone. The discussion around this topic touches on the DMCA and its impact on security research.

  Several technical details are also discussed in the comments. Users discuss the specific nature of the race condition exploited, the challenges in triggering it reliably, and the methods used to gain control of the system once the vulnerability is successfully triggered. There's mention of the "CB" or "ColdBoot" exploit and its relationship to the described vulnerability. Some users delve into the specific hardware and software components of the Xbox 360 involved in the exploit.

  A few commenters reminisce about the Xbox 360 modding scene, sharing their experiences and memories. One user mentions the excitement and community surrounding these kinds of exploits back in the day.

  Finally, some comments focus on the blog post itself, praising the author's clear writing style and the detailed explanation of the exploit. One commenter appreciates the inclusion of diagrams and code snippets, making the complex technical details more accessible.

  In summary, the comments on the Hacker News post offer a mix of technical analysis, ethical considerations, and nostalgic reflections on the Xbox 360 hacking scene. They highlight the cleverness of the exploit while also acknowledging the potential for its misuse. The discussion provides valuable context and insights for anyone interested in the technical details or the broader implications of this kind of security research.

• How to gain code execution on hundreds of millions of people and popular apps

  permalink

  Posted: 2025-02-28 21:05:35

  Verbose tl;dr

  The blog post details a vulnerability in the "todesktop" protocol handler, used by numerous applications and websites to open links directly in desktop applications. By crafting malicious links using this protocol, an attacker can execute arbitrary commands on a victim's machine simply by getting them to click the link. This affects any application that registers a custom todesktop handler without properly sanitizing user-supplied input, including popular chat platforms, email clients, and web browsers. This vulnerability exposes hundreds of millions of users to potential remote code execution attacks. The author demonstrates practical exploits against several popular applications, emphasizing the severity and widespread nature of this issue. They urge developers to immediately review and secure their implementations of the todesktop protocol handler.

  This blog post, titled "How to gain code execution on hundreds of millions of people and popular apps," details a security vulnerability discovered by the author, affecting applications that utilize the "todesktop" protocol handler within web browsers. This protocol, designed to facilitate seamless transitions between web applications and their corresponding desktop counterparts, presents a significant attack surface when implemented insecurely.

  The core issue revolves around the lack of proper input validation and sanitization within applications that register themselves as handlers for the "todesktop" protocol. The author explains that when a user clicks a specially crafted link containing a malicious "todesktop" URL, the associated desktop application might blindly execute the provided parameters without sufficient scrutiny. This vulnerability allows malicious actors to inject arbitrary commands into the application's command-line arguments, potentially leading to remote code execution.

  The blog post provides a comprehensive breakdown of the attack process. It starts by explaining how an attacker could craft a malicious URL that triggers the "todesktop" protocol handler. It then details how a vulnerable application, upon receiving this URL, might directly pass the embedded parameters to its underlying command-line interface. The author emphasizes that this direct execution of unsanitized user-supplied input creates a critical security flaw, as it allows attackers to effectively control the application's behavior.

  Furthermore, the post highlights the widespread impact of this vulnerability, noting its potential to affect hundreds of millions of users across various popular applications. The author underscores the severity of the issue by demonstrating practical examples of how the vulnerability can be exploited to gain control over a victim's system. These examples range from relatively simple actions, such as opening arbitrary files or websites, to more sophisticated attacks involving the execution of arbitrary code.

  The post also delves into the technical intricacies of the vulnerability, explaining how it stems from a combination of factors, including the design of the "todesktop" protocol itself, the lack of clear security guidelines for its implementation, and the prevalent practice of inadequate input validation in many desktop applications. The author emphasizes the importance of proper input sanitization and validation as a crucial mitigation strategy against this type of attack.

  Finally, the post offers recommendations for developers to secure their applications against this vulnerability. The author advises developers to thoroughly validate and sanitize all user-supplied input, especially when handling URL parameters and command-line arguments. The post also suggests adopting a more restrictive approach to handling the "todesktop" protocol, including implementing strict whitelisting of allowed commands and parameters. This detailed explanation, coupled with practical examples and concrete remediation advice, provides a valuable resource for developers seeking to protect their applications and users from this potentially widespread security risk.

  • Code Execution
  • Vulnerability
  • Security
  • exploitation
  • hacking
  • Software Security
  • Cybersecurity
  • desktop apps
  • popular apps
  • large-scale attack
  • software vulnerability
  • code injection
  • Malware
  • Application Security

  Summary of Comments ( 20 )
  https://news.ycombinator.com/item?id=43210858

  Verbose tl;dr

  Hacker News users discussed the practicality and ethics of the "todesktop" protocol, which allows websites to launch desktop apps. Several commenters pointed out existing similar functionalities like URL schemes and Progressive Web Apps (PWAs), questioning the novelty and necessity of todesktop. Concerns were raised about security implications, particularly the potential for malicious websites to exploit the protocol for unauthorized app launches. Some suggested that proper sandboxing and user confirmation could mitigate these risks, while others remained skeptical about the overall benefit outweighing the security concerns. The discussion also touched upon the potential for abuse by advertisers and the lack of clear benefits compared to existing solutions. A few commenters expressed interest in legitimate use cases, like streamlining workflows, but overall the sentiment leaned towards caution and skepticism due to the potential for malicious exploitation.

  The Hacker News post discussing the blog post "How to gain code execution on hundreds of millions of people and popular apps" has generated a significant number of comments, mostly revolving around the security implications of the todesktop protocol and its potential for misuse.

  Several commenters express concern about the ease with which malicious actors could exploit this protocol. They point out that the broad registration of todesktop handlers by many popular applications creates a large attack surface. One commenter highlights the potential for phishing attacks, where a malicious website could trick users into opening a crafted link that would then execute arbitrary code on their machine via a vulnerable application. Another user emphasizes the danger posed by typosquatting, where a slightly misspelled domain could register a todesktop handler and intercept traffic intended for a legitimate application.

  The discussion also touches on the responsibility of browser vendors in mitigating this threat. Some commenters argue that browsers should implement stricter security measures for handling todesktop requests, such as requiring user confirmation or limiting the types of applications that can register handlers. Others suggest that browsers should provide more prominent warnings about the potential risks associated with this protocol.

  A few commenters question the practicality of exploiting this vulnerability on a large scale. They point out that while the potential attack surface is large, successfully executing a widespread attack would require significant resources and expertise. However, others counter that the potential rewards of a successful attack, such as gaining access to sensitive data or disrupting critical infrastructure, are substantial enough to incentivize malicious actors.

  The lack of a clear solution is also a recurring theme in the comments. While some propose potential mitigation strategies, such as stricter browser security or improved developer awareness, there's no consensus on the best approach. Some commenters express frustration with the current state of web security and the apparent lack of foresight in designing protocols like todesktop.

  Some more technically inclined commenters discuss the specifics of the todesktop protocol and how it could be improved. They suggest ideas such as using cryptographic signatures to verify the legitimacy of todesktop requests or implementing a more granular permission system for applications that want to register handlers.

  Finally, a few commenters express skepticism about the severity of the issue, arguing that similar vulnerabilities have existed for years without being widely exploited. They suggest that the author of the blog post may be overstating the potential impact of this vulnerability. However, these comments are generally met with disagreement from other users who emphasize the growing reliance on web applications and the potential for significant damage if this vulnerability were to be exploited on a large scale. The overall tone of the discussion is one of concern and a desire for a more secure solution to handle custom URL protocols like todesktop.