News for hackers. Stuff that matters.

A comment on How We Exploited CodeRabbit: From Simple PR to RCE and Write Access on 1M Repos. Parent comment

Re:How We Exploited CodeRabbit: From Simple PR to RCE and Wr... by neandrake on Tuesday August 19, 2025 @10:59PM (#44958271)
They first disabled rubocop to prevent further exploit, then rotated keys. If they awaited deploying the fix that would mean letting compromised keys remain valid for 9 more hours. According to their response all other tools were already sandboxed.

However their response doesn't remediate putting secrets into environment variables in the first place - that is apparently acceptable to them and sets off a red flag for me.

[ Parent | on HN ]
Re:How We Exploited CodeRabbit: From Simple PR to RCE and Wr... by shlomo_z on Wednesday August 20, 2025 @12:16AM (#44958583)
> putting secrets into environment variables in the first place - that is apparently acceptable to them and sets off a red flag for me

Isn't that standard? The other options I've seen are .env files (amazing dev experience but not as secure), and AWS Secrets Manager and similar competition like Infisical. Even in the latter, you need keys to authenticate with the secrets manager and I believe it's recommended to store those as env vars.

Edit: Formatting

[ Parent | on HN ]
Re:How We Exploited CodeRabbit: From Simple PR to RCE and Wr... by vmatsiiako on Wednesday August 20, 2025 @01:09AM (#44958801)
You can use native authentication methods with Infisical that don't require you to use keys to authenticate with your secrets manager: - https://infisical.com/docs/documentation/platform/identities... - https://infisical.com/docs/documentation/platform/identities...
[ Parent | on HN ]
Re:How We Exploited CodeRabbit: From Simple PR to RCE and Wr... by KingOfCoders on Wednesday August 20, 2025 @01:14AM (#44958824)
"According to their response all other tools were already sandboxed."

Everything else was fine, just this one tool chosen by the security researcher out of a dozen of tools was not sandboxed.

[ Parent | on HN ]
Re:How We Exploited CodeRabbit: From Simple PR to RCE and Wr... by darkwater on Wednesday August 20, 2025 @02:20AM (#44959165)
Yeah, I thought the same. They were really unlucky, the only analyzer that let you include and run code was the one outside of the sandbox. What were the chances?
[ Parent | on HN ]
Re:How We Exploited CodeRabbit: From Simple PR to RCE and Wr... by Jap2-0 on Wednesday August 20, 2025 @11:20PM (#44968732)
Duh. Thanks for pointing that out.
[ Parent | on HN ]