Thread

A heap overflow and SSO misconfiguration to compromise OpenAI internal repos

491 points · 208 comments · Handy-Man

nikcub · 1789708810 · focus · HN ↗
Reading the patch[0] for libheif the bug which lead to the vuln was around bounds checking for image overlays. the container can have multiple images and you can compose them in the output.
heif also supports rotating, cropping, alpha channels, thumbnails and a ton of other features that a web forum where a user is uploading photos or screenshots doesn't need.
It's a much, much larger attack surface than plain old school JPEG.
I'd suggest rather than wait for the next bug to appear in this or another image lib to keeping things simple - stick to plain JPEG and handle image conversion in the client (wasm in the browser) if you really need to support users uploading iphone images.
Media decoding is so hard - there have been tons of bugs in ffmpeg and imagemagick and the core libs. You really need to think about how much of it you expose via a web server
[0] <a href="https://github.com/strukturag/libheif/commit/85e21ad44eba931314337300a2376b8d28f085ae" rel="nofollow">https://github.com/strukturag/libheif/commit/85e21ad44eba931...
1. Kevcmk · 1789710188 · focus · HN ↗
  Or OpenAI can adequately sandbox / access control the backend compute so RCE isn’t a path to lateral movement
  Defense in depth here would have been adequate
  1. nikcub · 1789710244 · focus · HN ↗
    Defense in depth + defense in breadth - aka. all of the above
    sandbox escapes have been the rage recently
    srcreigh · 1789711773 · focus · HN ↗
    Not firecracker
    tarxvf · 1789713306 · focus · HN ↗
    please don't jinx it
    sroussey · 1789715720 · focus · HN ↗
    Yeah, isn’t that Claude Codes sandbox? That drops and every npm install it taking over the world, lol.
    glitchcrab · 1789716912 · focus · HN ↗
    No, it is sandboxed by Bubblewrap on Linux and Seatbelt on Mac

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.