🚨Vulnerability Found in sr.ht Builds Service
A critical security flaw in a popular hosting service
TL;DR
A critical security flaw was found in the builds service of sr.ht, allowing malicious input to execute payloads in browsers. The issue was patched, and the fix was released to PyPI.
A security researcher discovered a critical vulnerability in the builds service of sr.ht, a platform that pays for hosting projects. The flaw allowed a malicious input string to create build jobs that could execute payloads in every browser viewing the build log. The payload could be downloaded from an attacker's website, and the build log page contained a CSRF token. The issue was patched in builds.sr.ht to auto-sanitize the output from ansi2html, and the fix was released to PyPI. This highlights the importance of continuous security audits in open-source projects. The vulnerability was reported and fixed in ansi2html, a library used for converting ANSI escape codes to HTML.
Key Points
sr.ht's builds service was vulnerable to a malicious input string that could create build jobs.
The build jobs could execute payloads in every browser viewing the build log.
The payload could be downloaded from an attacker's website, exploiting a CSRF token.
The vulnerability was fixed by auto-sanitizing ansi2html output in builds.sr.ht.
The ansi2html fix was released to PyPI, addressing the security issue.
Why It Matters
This vulnerability affects developers using sr.ht for hosting projects, as it could lead to unauthorized execution of code in their environments. The fix in ansi2html and builds.sr.ht ensures that future build logs are sanitized, preventing similar attacks. Developers and sysadmins should update their ansi2html installations to mitigate the risk.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,508 builders reading daily.