Node.js has just released fixes for 10 security vulnerabilities that could put node-powered applications at risk and is urging everyone to update their systems.
While the world reels from websites being taken down before critical PHP patches were released
Is it just me or did anyone else not even notice outside of articles lol… It was all resolved by the time I got off work.
It’s not resolved until everyone installs the patch. And there in lies the problem.
An important point yes and I do understand that, but the major players like Steam were updated and done before I knew it. I have no doubt this could come back to bite companies/people lagging behind over the next few years, but the impact to me from websites being taken down was 0, which was my point.
some sites in my region that people use went down temporarily, but i never used them.
Imagine working in IT security. How bad a time are you having right now? Are we expecting things to become better or worse the next few months?
When you’ve been at battle stations for 12 years it just feels like another week.
Open a ticket and add it to the list.
Honestly let it burn.
I am… well sorta. My team has to deal with the cleanup and repercussions at least. Let’s just say this week was not fun. At all.
In addition to the eMudhra certs and the php issue, there were also issues with python, Oracle, Java, and node.js. The certs and php were definitely the highest profile. They shut down incoming traffic to university web servers for the php one. The certs would have been more of a problem if we had extremely short expiration times
Yeah, so here’s the thing. People keep trying to bash on PHP as if anything software isn’t manmade and comes baked with flaws that can be exploited. It’s the single reason why cybersecurity products are never going to stop being used because no matter what, it’s based on something somebody made.
It’s going to be flawed or be exploitable by some means. Yesterday it was Log4J, now it’s PHP, tomorrow it will be something else. It will never end. Companies deliberately also use this to force you to upgrade because they’ve abandoned “legacy” products that still work but which they no longer choose to maintain because they want more money and need to stifle you for it somehow.
Has pure HTML (no css, no javascript) ever had a serious security issue? On the server side obviously not (outside of the apache/nginx/etc. having application bugs), but even on the client side has there ever been an exploit?
I build custom websites that run primarily on css and html. Light JS for applications, and some simple PHP to tie everything together. I am unaware of any flaw or exploit that would disable my sites. I don’t recall any html vulnerabilities. Unless there’s e-commerce involved, that’s nothing I can think of that would be exploitable on either side for html or css. These are both hard coded into the browser so I’m not even sure what an exploit would accomplish other than changing values on the client side. But it’s been a long week…
Edit Looks like zarobi below remembered some exploits. Totally forgot about iframes and the weird image data exploits.
Yeah but if it’s just pure HTML you got an ugly-ass website that’s annoying to use. There’s been many JavaScript and css vulnerabilities over the years of course. But yes there was and still is plain HTML issues
Client side:
- I vaguely remember some base64 embedded encoding malware.
- I do believe there was some issues with early HTML, if you had malformed tags, that could bypass checks and balances.
- Svg, Images, audio, fonts, and video can definitely contain malware. Before you say fonts are a css thing, <font> was a real tag
- IFrames were the worst:
- They had too much power in the past and could hijack the page and browser.
- There was no content security policy back then so they could inject JavaScript into the main page as well.
- Also they can cover the whole screen and present a normal login screen, and hijack all inputs going through it. Think of it like you’re on dodgey-site.com and it has a full page IFrame to bank.com. This was a common hack back in the day which inspired an entire http header to help prevent this.
- Anchor tags can link to something dodgey of course.
- Embedded PDFs were a huge issue.
- ActiveX and other web applets was just fucked. They were so bad they caused malware constantly. This is where unsolicited toolbars came from.
- Adobe Flash had many many vulnerabilities over the years.
- Canvas bugs are still a thing today.
Server side, you could execute SQL injection and path traversal just via URL before the page even loads. Malware and other issues can be embedded in text inputs. HTML can be uploaded to the server and in some cases replayed on the page affecting other users (comment sections were infamous for this).
So yeah; a plain HTML page with no JavaScript or css isn’t necessarily safe
I think there’s been one or two image decompression exploits over the years, so a site with a malicious file could end up running code on your system. I remember this being an issue with Minecraft clients and player skins at one point, but I can’t remember any specific times this happened in browsers tho.
Nothing wrong with static sites!
That would be the best result if everyone just went back to static sites.
but what about vulnerabilities in the web server? 😱
Just staple your website to a telephone pole
That’s why my site will always be html monke.
How many apocalyptic security flaws can fit into a week?
I never noticed how long the sales guy’s hand is
“This bad boy can hold so many limes”
yes
every time the sun rises, shines and sets; a million new node vulnerabilities are discovered
be careful, obviously, but don’t let it turn your entire nervous system into pure crystallized cortisol
you can deal with it on Monday
It is kinda funny to hear the manager say “Brotli” as if it were some cursed ancient artefact tho. I’m down to not tell the managers that this is overblown bs. Let them think that we saved the system from certain doom.
I mean I’ll update my Node version, but until someone actually finds an exploit chain on a real system (instead of a vibecoded PoC) I don’t see any reason to panic. All these "could"s and "would"s in the article suggest that it’s kind of a nothing-burger imo
If it’s really a PoC, it would actually execute and therefore exploit something (otherwise it wouldn’t be a proof). In which case it doesn’t matter if it’s vibecoded or not. If you succeed in breaching a system with it, there’s an issue that needs to be fixed.
That’s exactly the thing. They call themselves PoCs, but most of the time the exploit chain that they “prove” relies on some extremely unrealistic condition, like the intruder already having elevated privileges. Or it’s just completely made up and the PoC only “works” because the AI changed the source code. It’s incredibly unreliable.
I see. Yeah then it’s crap.
I’ll bet this is another “AI found a known vulnerability so people are making a big deal about it” like the PHP one.
I’m with you on the first part but I believe that 2/4 PHP exploits have been observed in the wild.
Pure sensationalism. We should celebrate new tools helping us to make oir software safer … but, nah, the end is nigh … start digging, and buy non-perishables, bullets, and lube
This what you get for running JS as your back end!
This always struck me as a rather silly idea, to be honest.
Now we’ve come full circle. I have a vendor who is insisting that I use node.js and pull their code from their NPM repository from the same… For frontend code. Just, have the entire contents of your (their) node_modules folder exposed to the public internet at all times. Isn’t this just Javascript with extra steps?
as an aside, i think the title is too sensationalist? click-baity?
A direct quote from the article:
Node.js flaws follow the PHP scare. Is this the end of the web?
So yeah, click-baity. The structure of the article was awkward too with lots of repetition, which makes me suspect at least some LLM use.
No. Put the Genie back in the bottle. We need air traffic control for this shit. Or we just have to shut down all the PHP and NodeJs servers. (This is sarcasm…mostly.)
Uh oh, the cracks in our software castles get bigger.
INB4 Pheonix devs
What about Lua? https://hachyderm.io/@ell1e/117480515499692140 I think e.g. nginx and OpenDKIM have Lua scripting integrations.
Maybe like… code your backend in a real programming language?
HTML 1.0
cgi-bin
I’ve not heard of any recent COBOL vulnerabilities
Too high level - real devs code in assembler
Use web assembly, got it.
Most of it is working around weaknesses of tcp anyway.
