TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

We recently awarded our biggest bug bounty payout

113 点作者 projuce超过 11 年前

9 条评论

tptacek超过 11 年前
XXE&#x27;s are awful. You wouldn&#x27;t think that simply by parsing an XML file --- something so simple people are tempted to do it with regexes --- you&#x27;d be invoking machinery that translates the XML language and binds it to, in effect, scripting language features. But that&#x27;s what you&#x27;re doing when you use common XML libraries!<p>For applications on mainstream stacks, if you accept XML inputs (explicitly accept them, that is; as in, invoke the XML parser yourself) and haven&#x27;t taken the time to make sure you&#x27;re not expanding entities, the safest bet is to assume that your XML parser has a &quot;let inbound XML run shell commands&quot; feature embedded into it. That&#x27;s an oversimplification, but maybe not much of one.<p>This is a great, subtle finding. And Reginaldo handled it like a pro. Let the feeding frenzy for hiring Reginaldo Silva... commence! :)
评论 #7106150 未加载
评论 #7106530 未加载
评论 #7106415 未加载
reginaldo超过 11 年前
Hi HN, I&#x27;m the one who found the bug. My writeup is at <a href="http://www.ubercomp.com/posts/2014-01-16_facebook_remote_code_execution" rel="nofollow">http:&#x2F;&#x2F;www.ubercomp.com&#x2F;posts&#x2F;2014-01-16_facebook_remote_cod...</a>. I&#x27;d be glad to answer any questions. I won&#x27;t disclose the amount for now because I want to know what people think this would be worth, but eventually it will be disclosed. If you run an OpenID-enabled server now it&#x27;s a great time to make sure your implementation is patched.
评论 #7106026 未加载
评论 #7107142 未加载
qq66超过 11 年前
The fact that Facebook is paying $33,000 for a remote code execution bug might one of the big reasons that it&#x27;s the biggest bug that&#x27;s been reported to them.
michaelt超过 11 年前
I wonder whether the non-malicious applications of XML external entities outnumber the malicious applications.<p>Any HNers want to chime in with an account of actually using them for what they&#x27;re meant for?
评论 #7106268 未加载
chmars超过 11 年前
The payment was apparently USD 33&#x27;500.
评论 #7106793 未加载
gesman超过 11 年前
&#x2F;Leaving aside XML techno babble&#x2F;:<p>&gt;&gt;&gt; ... We knew we wanted to pay out a lot because of the severity of the issue, so we decided to average the payout recommendations across a group of our program administrators. As always, we design our payouts to reward the hard work of researchers who are already inclined to do the right thing and report bugs to the affected vendors. ... &gt;&gt;&gt;<p>So, instead of awarding bounty to the researcher who found and intelligently handled the disclosure of the issue, Facebook &quot;decided to average the payout&quot; in order to keep part of the bounty to themselves, rewarding themselves for &quot;hard work&quot; and glorifying themselves for &quot;awarding our biggest bug bounty payout ever&quot; ?
评论 #7108678 未加载
nl超过 11 年前
XXE&#x27;s are nasty. Back in the early 2000&#x27;s I found every single Java RSS parsers (pack then that was an important thing) was vulnerable.<p>I submitted patches for them all, but it was kinda nasty to fix in Java, because each XML parser had different custom properties to set. <a href="https://github.com/rometools/rome/blob/master/src/main/java/com/sun/syndication/io/WireFeedInput.java#L311" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;rometools&#x2F;rome&#x2F;blob&#x2F;master&#x2F;src&#x2F;main&#x2F;java&#x2F;...</a> is the hackiness I had to do for ROME.
评论 #7107534 未加载
po超过 11 年前
This was in PHP but the problem exists in most languages. For all of you python programmers out there check out defusedxml and use it. They have a good explanation of many of the dangers in XML parsing:<p><a href="https://pypi.python.org/pypi/defusedxml" rel="nofollow">https:&#x2F;&#x2F;pypi.python.org&#x2F;pypi&#x2F;defusedxml</a>
ambrop7超过 11 年前
If they went the NIH way and implemented the XML parsing themselves, this never would have been an issue.
评论 #7106846 未加载