News for hackers. Stuff that matters.

A comment on Everything Old Is New Again: Binary Security of WebAssembly [pdf]. Parent comment

Re:Everything Old Is New Again: Binary Security of WebAssemb... by chubot on Friday April 30, 2021 @01:43PM (#26996738)
Section 5.1 gives a good example: an image sharing service that processes images using libpng. This has to be combined with a document.write() of HTML in C, which is realistic.

Someone who controls the image data can perform an XSS, i.e. steal your credentials for the website, or your credit card info if that's stored server-side. That's not as valuable a target as controlling your computer, but it's not nothing, and can be chained.

This is completely realistic as Figma is full blown image editor written in C++ compiled to WebAssembly :)

https://www.figma.com/blog/webassembly-cut-figmas-load-time-...

[ Parent | on HN ]
Re:Everything Old Is New Again: Binary Security of WebAssemb... by skyde on Friday April 30, 2021 @02:52PM (#26997681)
"Someone who controls the image data" to me that sound like something outside the sandbox manipulating the image data given to the sandbox.

If this is the case it mean there is already a hacker or virus running outside the sandbox which mean I already have bigger problem to worry about :).

[ Parent | on HN ]
Re:Everything Old Is New Again: Binary Security of WebAssemb... by tasogare on Friday April 30, 2021 @03:45PM (#26998355)
No, it means a random user can upload a malicious image and hack the service.
[ Parent | on HN ]