737
u/KCGD_r 2d ago
TL;DR it's node2shell but on http servers. So the whole thing is just the brotli vulnerability, but http servers usually offer brotli compression so they could be vulnerable.
How to fix: if you can't immidiately change node versions, just drop all content requesting "br" encoding
If you can switch: versions 22.23.4, 24.22.1 and 26.12.1 are patched
156
u/thisisapseudo 2d ago
Too dumb did not understand: what can be done by whom?
206
45
u/NatoBoram 2d ago
Software application developers can update their Node/Python version when they distribute their server-side software
People who deploy those software maybe can or cannot update that software, depending on if there's an update released
If you don't make Node/Python apps or host one, then sit back and enjoy the rest of the world catching fire
I recommend Fireship for following this kind of news in a more digestible way: https://www.youtube.com/watch?v=SMGg7iisHmc
13
u/KCGD_r 2d ago
The way to actually fix the vulnerability is to use a patched versions of node.js (I listed in the first comment). These specific versions contain a fix which removes the vulnerability entirely.
The person who runs the server / controls the webserver software can switch the version of Node.JS the server uses, and should switch to one of these patched versions of node.js if possible.
If they can't switch nodejs versions immidiately (like if you have version dependent code or don't have permission to switch the node runtime), then you can edit the server's JavaScript code to reject all requests that want to use brotli encoding
17
22
1
u/Plazmaz1 1d ago
A little worse than that. Node and many many other languages use the same native implementation which is where the actual bug lives.
171
u/YMK1234 2d ago
stupid name, it's brotli2shell. just disable brotli (probably not enabled to begin with) and you are golden.
38
25
u/Not-the-best-name 2d ago edited 2d ago
Not that easy. Python web app for example, Brotli is used if available on your system even if not imported or used by your code. Request libs use it if they find it. You may not install it as part of your web stack, but some other dependency like GDAL (geospatial analysis) might have installed it for itself.
→ More replies (1)6
u/WriterPlastic9350 2d ago
Node does this as well. It is why those languages are (IMO, incorrectly) being reported as "vulnerable". They are, but the vulnerability is actually in anything that uses the brotli lib. It's just Node and Python "helpfully" will handle that encoding for you if the client to your server (or the server you're sending a request to) asks you to, and you have to opt-out of that, if you even can.
Use a sensible language like Go, or other frameworks which don't rely on magic under the guise of features.
79
u/lart2150 2d ago
IDK I'm having way more fun running a MITM proxy with every IOT device in my home thanks to emudhra.
23
u/Anongirl55959 2d ago
Shit thats actually smart and u can stop them from ever receiving the updated certs too
9
u/Risky_Sandwich 1d ago
Wait, what does this allow you to do? Say you have one of those fancy webos tv's, can you see what is inside the telemetry now?
26
u/lart2150 1d ago
yep I was able to see everything my samsung tv sends over https. my pihole was blocking the telemetry but it would report every key press, app launch, etc. A linux box with two ethernet ports and https://docs.mitmproxy.org/stable/concepts/options/#emudhra makes it stupid easy.
I've since built a more long term proxy with a self issued cert that removes all the garbage from my tv's home screen.
4
u/Anti-Kriztos-One 1d ago
Nice setup. Its also possible with one eth or ethand wlan?
4
u/lart2150 1d ago
you can use wireless aswell. some adapters work better than others. I ended up plugging my access point into the eithernet port and was able to poke everything on that ap.
5
u/YouDoHaveValue 1d ago
This will be the primary driver for manufacturer's to maintain their shit.
3
u/lart2150 1d ago
will it? #TIL my radon detector that is still being sold is a esp32 and makes https requests with no auth and does not verify the cert at all.
At the other end of the spectrum MTLS stops this in the tracks just like ca/cert pinning.
→ More replies (1)
89
u/logan-duk-dong 2d ago
If Al Gore could take the initiative and uncreate the Internet, that'd be great.
70
u/emuboy85 2d ago •
I don't know il you are talking about Al Gore or AI Gore but I'm here for both.
21
4
u/sam_tiago 2d ago
Still wonder what the world would be like now if he didn’t get shafted by corruption in 2000
1
u/KlanxChile 1d ago
I'm pretty sure, if his sponsors sell a competing products he would be all over it...
223
u/OmegaPoint6 2d ago
Might as well just go back to CGI at this point
111
u/eXecute_bit 2d ago
Like things were better in Perl? What do you think made me first learn PHP?
63
u/OmegaPoint6 2d ago
Just code your website directly in bash scripts
40
u/eXecute_bit 2d ago
Can't we just have
initopen a TCP listen socket and skip all these middle layers?42
17
→ More replies (2)8
u/Hero_without_Powers 2d ago
Bash is love, bash is life
3
u/Square_Ad4004 1d ago
> Bash looks him straight in the eye and says. "It's all command line now"
> Bash leaves through my window6
u/SynthPrax 2d ago
Did someone mention Perl?
2
u/Steve_orlando70 1d ago
Ah, Perl, the programming language whose programs are most easily confused with line noise (for those who remember both).
(Apologies to APL, I put you in second place, too few people had the Selectric ball...)
17
14
550
u/badgersruse
2d ago
•
I have said for decades that pretty much all software since punch cards has been steaming layers of unfinished and/or poorly designed shit, because it is either ‘too expensive’ or too boring or too hard or ‘not worth it’ to do it right.
And here we are.
166
u/Slight-Violinist-575 2d ago
The more layers a piece of tech has, the more surface it has for vulnerabilities
I think it’s easier to see it in cars, we just recently had a F1 race which had to be restarted because the cars’ software wouldn’t run properly
41
u/yabucek 2d ago
F1 110% brought that particular fuckup on themselves.
Literally nobody asked that the onboard computer should control power deployment in a racecar.
→ More replies (3)→ More replies (1)3
u/badgersruse 2d ago
You are kind of missing the point. I’m not talking about dealing with vulnerabilites. I’m talking about doing it so there aren’t 1000s of vulnerabilities in the first place.
17
u/Slight-Violinist-575 2d ago
But that isn’t exclusive to software, much less to “software from a point of time onwards only”
→ More replies (2)15
8
u/Educational-Plant981 2d ago
when you notice that someone fucked up the shape of the mustache on the Jack at the bottom of the card tower, even if it is a single penstroke to fix, it isn't easy to do.
5
u/phasmaglass 13h ago
Yeah I gave up and started phoning it in immediately bc I realized no corporate boss willing to pay me what I needed to live would ever allow me to make anything good, and I'd never have the energy to make something good myself due to spending all my coding energy at my corporate job. Then watched over the past 20 years as they kept adding more and more layers to the stack we're intended to know top to bottom (very few people do and they aren't working for your boss, FYI) and how little people making the big decisions actually knew... I realized all I could look forward to for being good at my job was picking up slack for people who would be paid more than I would, so no thanks.
I got good enough to do what I need to do and not get fired, lost my passion for it along that process, and now spend my time shaking canes on Reddit.
I think a lot of people are in a similar situation. Hang in there guys.
2
→ More replies (2)2
u/hetfield37 2d ago
Adding more code to fix bugs, especially those hard to reproduce, oftentimes brings more bugs with that. The more complex the code is, the bigger chance of forgetting something is.
173
u/Old-Age6220 2d ago
Time to ditch internet and go back to great Finnish invention: IRC 😂
99
15
12
7
19
u/nidelv 2d ago
How do you run IRC without internet? Run it on a different distributed network?
27
u/WriterPlastic9350 2d ago
I think perhaps the person you're responding to meant internet as in the worldwide web rather than internet as in the network
5
u/nidelv 2d ago
Yeah, that is a common interpretation, Internet = www
15
4
u/Old-Age6220 2d ago
Heh, yeah, even the name has "internet" in it 😂 On isolated networks for example. I was like of refering it being more text based and "limited", so it might have less "attack surface". But let's not spoil the good joke with a truth 🤣 (old Finnish proverb)
3
2
u/melophat 2d ago
Back to dial-up we go! All of those old AOL free trial cds I have in my basement will finally be worth something again... If only I still had a cd-rom drive!
→ More replies (1)1
u/RevolutionaryElk7446 2d ago
Well you'd technically be fine as this is HTTP2SHELL and that's the WWW and not the Internet.
So your IRC would be fine.
4
3
2
2
3
1
u/henrikhakan 2d ago
On a serious note, I think this is where we are headed if Ai is allowed to run amok by itself for a couple of years.
1
1
1
→ More replies (4)1
40
19
u/fugogugo 2d ago
what did I missed now?
22
u/auxiliary-username 2d ago
14
u/erishun 2d ago
I was told it was only PHP that was bad?
37
9
u/auxiliary-username 2d ago
This one is unrelated to the PHP vulnerability, although it's the same class (a remote code execution, or RCE), and the same severity (9.2).
It was originally announced on the same day as php2shell, but this one is in the Brotli compression library. It was originally only announced as a NodeJS RCE, but it turns out it affects a whole bunch of over languages, such as NodeJS, Python, C++ etc.
4
u/PGSylphir 2d ago
There is 2 types of languages, bad ones and the ones people complain about.
→ More replies (1)
17
55
u/UltraGaren 2d ago edited 2d ago
Meanwhile game devs not even noticing other branches of programming are falling apart
Edit: holy shit guys it was a joke, chill
51
30
u/Designer_Storm8869 2d ago
Absolutely not. They are affected even worse. Release a trailer of your unreleased game and someone is going to vibecode it and release it before you.
17
u/doktorjake 2d ago
It’s literally reversed, friend. Other branches of programming are finally starting to feel what game devs have been feeling for the past 2 years.
9
u/Anubis17_76 2d ago
head over to r/Steam and try to find a post thats not about the next fest being infected with AI Slop games.
7
u/karateninjazombie 2d ago
That avalanche of shit started when valve stopped reviewing submissions to steam themselves and just said fuck it. Vote on what you want with steam green light. Then there was the indie-pocolypse crapfest and torrent of utter drivel that followed. Now we in the early access and preorder shower of airborne brown things. With the rise of AI rubbish coming in hard at present.
Valve could do better at picking what is and isn't out on the store tbh. Not everyone should be allowed to code. Much the same as not everyone should be allowed to write a book.
→ More replies (1)3
1
u/WriterPlastic9350 2d ago
Most AAA games these days are, for better or worse, live service, so we are very aware of this haha.
37
14
5
8
4
26
u/4e_65_6f 2d ago
It's already patched. I don't get the drama.
I didn't even have to do anything the hosting team patched as soon as it came out.
88
u/ApprehensiveStand456 2d ago •
Hosting team here. You never say thank you.
14
u/4e_65_6f 2d ago
I did though. I even gave five stars to the analyst that I spoke to. Hope the dude gets a raise or a day off at least.
3
2
u/intbeam 2d ago
🙄
2
u/NatoBoram 2d ago
Right‽ Like I haven't spent the night upgrading my SvelteKit app I haven't touched in a year because everything worked fine until now!
3
3
3
u/Adorable_Ice_2963 2d ago
Damn AI! If people knew how their program down to assembly Level, this wouldnt have happend!
2
3
u/ShotgunPayDay 2d ago
I like to wave to all these vulnerabilities as I pass them by riding on my Blue Gopher.
1
u/Plazmaz1 1d ago
2
u/ShotgunPayDay 20h ago
At least it panics instead of giving a shell. I'm also not using andybalholm implementation and using klauspost instead. It's good to know though thank you.
→ More replies (1)1
3
u/Academic-Proof3700 2d ago
Its time people started hosting their shitty websites on containers rather than entire servers.
7
u/sn4xchan 1d ago
Sure because escaping out of docker is impossible.
2
u/alex-weej 1d ago
Locked door argument
3
u/Plazmaz1 1d ago
Containers aren't designed to be security boundaries, use vms.
→ More replies (10)
2
2
u/HoratioWobble 1d ago
Thankfully we wrote perfect, artisan code before AI so this was just a fever dream... right?
2
1
1
1
1
u/Lazy-Good1433 3h ago
I do not find this funny in my case >:(
Me losing server access to pre-orders online is costing a lot of grief and concerns.
1
u/tomerFire 1d ago
Why the ability to inject shell commands like the even exists.
It like in cartoons when they press the big red self destruct button and you ask yourself why this button even exist
5
u/ArjixGamer 1d ago
Uhhhhhhh, it wasn't designed that way, so it's nothing like the cartoons comparison you made.
2
u/RazzmatazzUnusual843 22h ago
Okay, so basically... AI has been doing a lot of reverse engineering, including game decomps and finding security holes in things. CVEs have then been getting discovered in widely used frameworks at an alarming rate over the past handful of months, right around the same time reverse engineering took off. There was never a "big red button" to begin with or someone would've already caused this decades ago. There are two dots. Please connect them.
1
u/tomerFire 22h ago
Why would you create a tool to excute code/command like this?
→ More replies (7)1
-2
u/Bomaruto 2d ago
This is why everything should be rewritten in Rust.
15
u/quixotik 2d ago
RUST2SHELL
3
u/-Redstoneboi- 2d ago
one of these days someones gonna figure out how to do an rce via memory leak into panic catch unwind into unsafe memory read on whatever poison was left over by the previous thread, or something idk what im talking about
2
u/Risky_Sandwich 1d ago
Claude, please implement -Redstoneboi-'s idea.
On it boss, spinning up 100 subagents.
→ More replies (1)4
1.9k
u/WriterPlastic9350 2d ago •
I work in security. I am so tired boss. Every day this last week I woke up to another critical cve
With how much my career has changed this last year I am burning out so hard.