Post by Valued Goose - blankpad.net

blankpad.net

3h

oh COME ON can we not at least have a weekend off https://broccoli2shell.com

Who's exposed
You're at risk if your code, or any library it uses, decompresses Brotli data that someone else controls. That happens in more places than you'd think, because HTTP clients decompress Brotli responses on their own.

Your app fetches a URL
Node's built-in fetch() decodes Content-Encoding: br responses automatically. So do Python's requests/urllib3 and aiohttp whenever a Brotli package is installed. Any server you talk to can send the payload, whether through webhooks, link previews, crawlers or "import from URL" features.

Your app accepts uploads or request bodies
Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0 inflate Brotli request bodies in parsers such as raw() and json(). Python frameworks and middleware that decode br bodies are exposed in the same way. A bare node:http server doesn't decode bodies by itself.

Your app calls the decoder directly
This means zlib.brotliDecompress*(), createBrotliDecompress(), brotli.decompress(), and any library that uses them on archives, caches or queue messages.

1 1 0 View Post & Replies See Original

3h

@jonty this really has not been the best week for web tech has it…

Imma go hide behind my firewall now

1 0 0 View Post & Replies See Original

2h

It's Cybersecurity Awareness Month

ARE YOU AWARE YET?

0 1 1 View Post & Replies See Original