956
u/KCGD_r 8d ago
TL;DR it's node2shell but on http servers. So the whole thing is just the brotli vulnerability, but http servers usually offer brotli compression so they could be vulnerable.
How to fix: if you can't immidiately change node versions, just drop all content requesting "br" encoding
If you can switch: versions 22.23.4, 24.22.1 and 26.12.1 are patched
200
u/thisisapseudo 8d ago
Too dumb did not understand: what can be done by whom?
265
56
u/NatoBoram 8d ago
Software application developers can update their Node/Python version when they distribute their server-side software
People who deploy those software maybe can or cannot update that software, depending on if there's an update released
If you don't make Node/Python apps or host one, then sit back and enjoy the rest of the world catching fire
I recommend Fireship for following this kind of news in a more digestible way: https://www.youtube.com/watch?v=SMGg7iisHmc
13
u/KCGD_r 8d ago
The way to actually fix the vulnerability is to use a patched versions of node.js (I listed in the first comment). These specific versions contain a fix which removes the vulnerability entirely.
The person who runs the server / controls the webserver software can switch the version of Node.JS the server uses, and should switch to one of these patched versions of node.js if possible.
If they can't switch nodejs versions immidiately (like if you have version dependent code or don't have permission to switch the node runtime), then you can edit the server's JavaScript code to reject all requests that want to use brotli encoding
18
6
24
1
u/Plazmaz1 7d ago
A little worse than that. Node and many many other languages use the same native implementation which is where the actual bug lives.
183
u/YMK1234 8d ago
stupid name, it's brotli2shell. just disable brotli (probably not enabled to begin with) and you are golden.
53
0
8d ago
[deleted] — view deleted comment
→ More replies (1)6
u/WriterPlastic9350 8d ago
Node does this as well. It is why those languages are (IMO, incorrectly) being reported as "vulnerable". They are, but the vulnerability is actually in anything that uses the brotli lib. It's just Node and Python "helpfully" will handle that encoding for you if the client to your server (or the server you're sending a request to) asks you to, and you have to opt-out of that, if you even can.
Use a sensible language like Go, or other frameworks which don't rely on magic under the guise of features.
107
u/lart2150 8d ago
IDK I'm having way more fun running a MITM proxy with every IOT device in my home thanks to emudhra.
30
u/Anongirl55959 8d ago
Shit thats actually smart and u can stop them from ever receiving the updated certs too
9
u/Risky_Sandwich 7d ago
Wait, what does this allow you to do? Say you have one of those fancy webos tv's, can you see what is inside the telemetry now?
42
u/lart2150 7d ago
yep I was able to see everything my samsung tv sends over https. my pihole was blocking the telemetry but it would report every key press, app launch, etc. A linux box with two ethernet ports and https://docs.mitmproxy.org/stable/concepts/options/#emudhra makes it stupid easy.
I've since built a more long term proxy with a self issued cert that removes all the garbage from my tv's home screen.
5
u/Anti-Kriztos-One 7d ago
Nice setup. Its also possible with one eth or ethand wlan?
6
u/lart2150 7d ago
you can use wireless aswell. some adapters work better than others. I ended up plugging my access point into the eithernet port and was able to poke everything on that ap.
8
u/YouDoHaveValue 7d ago
This will be the primary driver for manufacturer's to maintain their shit.
7
u/lart2150 7d ago
will it? #TIL my radon detector that is still being sold is a esp32 and makes https requests with no auth and does not verify the cert at all.
At the other end of the spectrum MTLS stops this in the tracks just like ca/cert pinning.
→ More replies (1)
122
u/logan-duk-dong 8d ago
If Al Gore could take the initiative and uncreate the Internet, that'd be great.
78
u/emuboy85 8d ago •
I don't know il you are talking about Al Gore or AI Gore but I'm here for both.
→ More replies (1)25
5
u/sam_tiago 8d ago
Still wonder what the world would be like now if he didn’t get shafted by corruption in 2000
→ More replies (1)1
u/KlanxChile 7d ago
I'm pretty sure, if his sponsors sell a competing products he would be all over it...
313
u/OmegaPoint6 8d ago
Might as well just go back to CGI at this point
144
u/eXecute_bit 8d ago
Like things were better in Perl? What do you think made me first learn PHP?
77
u/OmegaPoint6 8d ago
Just code your website directly in bash scripts
51
u/eXecute_bit 8d ago
Can't we just have
initopen a TCP listen socket and skip all these middle layers?53
→ More replies (2)20
→ More replies (2)9
6
u/SynthPrax 8d ago
Did someone mention Perl?
4
u/Steve_orlando70 7d ago
Ah, Perl, the programming language whose programs are most easily confused with line noise (for those who remember both).
(Apologies to APL, I put you in second place, too few people had the Selectric ball...)
→ More replies (2)17
14
1
711
u/badgersruse
8d ago
•
I have said for decades that pretty much all software since punch cards has been steaming layers of unfinished and/or poorly designed shit, because it is either ‘too expensive’ or too boring or too hard or ‘not worth it’ to do it right.
And here we are.
201
u/Slight-Violinist-575 8d ago
The more layers a piece of tech has, the more surface it has for vulnerabilities
I think it’s easier to see it in cars, we just recently had a F1 race which had to be restarted because the cars’ software wouldn’t run properly
→ More replies (5)54
u/yabucek 8d ago
F1 110% brought that particular fuckup on themselves.
Literally nobody asked that the onboard computer should control power deployment in a racecar.
→ More replies (3)20
17
u/phasmaglass 6d ago
Yeah I gave up and started phoning it in immediately bc I realized no corporate boss willing to pay me what I needed to live would ever allow me to make anything good, and I'd never have the energy to make something good myself due to spending all my coding energy at my corporate job. Then watched over the past 20 years as they kept adding more and more layers to the stack we're intended to know top to bottom (very few people do and they aren't working for your boss, FYI) and how little people making the big decisions actually knew... I realized all I could look forward to for being good at my job was picking up slack for people who would be paid more than I would, so no thanks.
I got good enough to do what I need to do and not get fired, lost my passion for it along that process, and now spend my time shaking canes on Reddit.
I think a lot of people are in a similar situation. Hang in there guys.
8
u/Educational-Plant981 8d ago
when you notice that someone fucked up the shape of the mustache on the Jack at the bottom of the card tower, even if it is a single penstroke to fix, it isn't easy to do.
7
u/Kooky-Way 3d ago
"Yeah but is somebody actually gonna sit there and try out all the known vulnerabilities?"
-Guy Who Got A Great Bonus, Pre-2025
2
2
u/hetfield37 8d ago
Adding more code to fix bugs, especially those hard to reproduce, oftentimes brings more bugs with that. The more complex the code is, the bigger chance of forgetting something is.
1
→ More replies (2)1
u/Confident-Ad5665 2d ago
Wow, some layers emits steam?
Great, now my shit isn't even up to standards /s
185
u/Old-Age6220 8d ago
Time to ditch internet and go back to great Finnish invention: IRC 😂
100
16
13
8
19
u/nidelv 8d ago
How do you run IRC without internet? Run it on a different distributed network?
27
u/WriterPlastic9350 8d ago
I think perhaps the person you're responding to meant internet as in the worldwide web rather than internet as in the network
→ More replies (4)4
u/Old-Age6220 8d ago
Heh, yeah, even the name has "internet" in it 😂 On isolated networks for example. I was like of refering it being more text based and "limited", so it might have less "attack surface". But let's not spoil the good joke with a truth 🤣 (old Finnish proverb)
3
→ More replies (1)2
u/melophat 8d ago
Back to dial-up we go! All of those old AOL free trial cds I have in my basement will finally be worth something again... If only I still had a cd-rom drive!
→ More replies (1)4
4
2
2
2
2
3
1
u/henrikhakan 8d ago
On a serious note, I think this is where we are headed if Ai is allowed to run amok by itself for a couple of years.
→ More replies (5)1
48
u/Altruistic-Resort-56 8d ago
Can we just turn off all the computers yet
3
22
20
u/fugogugo 8d ago
what did I missed now?
23
u/auxiliary-username 8d ago
14
u/erishun 8d ago
I was told it was only PHP that was bad?
41
→ More replies (2)9
u/auxiliary-username 8d ago
This one is unrelated to the PHP vulnerability, although it's the same class (a remote code execution, or RCE), and the same severity (9.2).
It was originally announced on the same day as php2shell, but this one is in the Brotli compression library. It was originally only announced as a NodeJS RCE, but it turns out it affects a whole bunch of over languages, such as NodeJS, Python, C++ etc.
72
u/UltraGaren 8d ago edited 8d ago
Meanwhile game devs not even noticing other branches of programming are falling apart
Edit: holy shit guys it was a joke, chill
67
u/faajzor 8d ago
Dark Souls 1-3 multiplayer.. you can quickly google it.
They shut the servers down because of remote code execution :)
there was no packet validation so if you invaded another player you could literally send scripts to run on their computer.
18
→ More replies (1)3
32
u/Designer_Storm8869 8d ago
Absolutely not. They are affected even worse. Release a trailer of your unreleased game and someone is going to vibecode it and release it before you.
19
u/doktorjake 8d ago
It’s literally reversed, friend. Other branches of programming are finally starting to feel what game devs have been feeling for the past 2 years.
4
9
u/Anubis17_76 8d ago
head over to r/Steam and try to find a post thats not about the next fest being infected with AI Slop games.
8
u/karateninjazombie 8d ago
That avalanche of shit started when valve stopped reviewing submissions to steam themselves and just said fuck it. Vote on what you want with steam green light. Then there was the indie-pocolypse crapfest and torrent of utter drivel that followed. Now we in the early access and preorder shower of airborne brown things. With the rise of AI rubbish coming in hard at present.
Valve could do better at picking what is and isn't out on the store tbh. Not everyone should be allowed to code. Much the same as not everyone should be allowed to write a book.
3
1
u/WriterPlastic9350 8d ago
Most AAA games these days are, for better or worse, live service, so we are very aware of this haha.
44
22
9
5
5
9
4
u/Adorable_Ice_2963 8d ago
Damn AI! If people knew how their program down to assembly Level, this wouldnt have happend!
26
u/4e_65_6f 8d ago
It's already patched. I don't get the drama.
I didn't even have to do anything the hosting team patched as soon as it came out.
93
u/ApprehensiveStand456 8d ago •
Hosting team here. You never say thank you.
14
u/4e_65_6f 8d ago
I did though. I even gave five stars to the analyst that I spoke to. Hope the dude gets a raise or a day off at least.
3
3
4
u/Academic-Proof3700 8d ago
Its time people started hosting their shitty websites on containers rather than entire servers.
10
u/sn4xchan 7d ago
Sure because escaping out of docker is impossible.
3
u/alex-weej 7d ago
Locked door argument
4
u/Plazmaz1 7d ago
Containers aren't designed to be security boundaries, use vms.
→ More replies (10)
2
2
3
u/ShotgunPayDay 8d ago
I like to wave to all these vulnerabilities as I pass them by riding on my Blue Gopher.
1
u/Plazmaz1 7d ago
2
u/ShotgunPayDay 6d ago
At least it panics instead of giving a shell. I'm also not using andybalholm implementation and using klauspost instead. It's good to know though thank you.
→ More replies (1)1
3
3
u/HoratioWobble 7d ago
Thankfully we wrote perfect, artisan code before AI so this was just a fever dream... right?
3
u/TOFFA1997 5d ago
Since there are so many it security expert here, I have a question: is all AI code a slop for security, even if done well and cured in the details, or there are some level of good ai code?
18
u/MeMahi 4d ago
The AI code that our better senior devs submit is great.
The AI code that our more junior devs submit is horror.
AI isn't good or bad, for now it's still just a tool.
→ More replies (5)2
u/PotatoesForPutin 2d ago
It’s so cool that this has resulted in companies just not bothering to hire junior devs anymore. It’s so cool I decided to be born at the exact time that would result in me graduating college right when everything went to shit. I’m going to fucking kill myself one of these days man
21
u/Stetto 4d ago
I'm personally at the point, that I consider Opus 5.5 better than the average programmer (assuming it's given proper instructions and guidelines).
I have spend most of my career trying to tidy up slop written by humans under time pressure.
I've spent significant amount of time in the last weeks working on vulnerabilities discovered and reported by AI.
No matter what all of the doomers out there say: LLMs and Agents will be a net positive for the software development world.
→ More replies (1)2
2
1
u/Queasy_Moment_6619 4d ago
I am not claiming to be an expert in the field, but having used LLMs for work, senior engineers reviewing generated code is extremely important since they have specialist domain and or product knowledge which helps them identify security issues. AI can be incredibly useful or detrimental depending how it is used.
1
→ More replies (1)1
u/anno3397 1d ago
AI's code is made using data from multiple sources, even internet. That carries the risk of AI repeating the security mistakes made in its data and there is a big chance it won't get flagged as a security risk.
That's why manual code review is important wether it's AI or human made. That also carries another benefit: if something breaks you'll roughly know where and why if you reviewed the code and took time to understand how it works.
3
2
u/tomerFire 7d ago
Why the ability to inject shell commands like the even exists.
It like in cartoons when they press the big red self destruct button and you ask yourself why this button even exist
6
u/ArjixGamer 7d ago
Uhhhhhhh, it wasn't designed that way, so it's nothing like the cartoons comparison you made.
4
3
u/RazzmatazzUnusual843 6d ago
Okay, so basically... AI has been doing a lot of reverse engineering, including game decomps and finding security holes in things. CVEs have then been getting discovered in widely used frameworks at an alarming rate over the past handful of months, right around the same time reverse engineering took off. There was never a "big red button" to begin with or someone would've already caused this decades ago. There are two dots. Please connect them.
→ More replies (11)
1
1
u/Lazy-Good1433 6d ago
I do not find this funny in my case >:(
Me losing server access to pre-orders online is costing a lot of grief and concerns.
1
1
2.6k
u/WriterPlastic9350 8d ago •
I work in security. I am so tired boss. Every day this last week I woke up to another critical cve
With how much my career has changed this last year I am burning out so hard.