Sourcehut account takeover via build logs (XSS in ansi2html)
2 hours ago
- Author set up a SourceHut instance paying for projects, leading to hacking on sr.ht repos.
- SourceHut's microservice structure includes builds.sr.ht and mirror.sr.ht for prebuilt packages.
- Building custom Alpine packages involves forking sr.ht-apkbuilds and using builds.sr.ht.
- Found wasteful CSS in build logs and investigated the ansi2html converter for ANSI escapes.
- Discovered XSS via OSC 8 hyperlinks: injection of arbitrary HTML attributes and javascript: URIs.
- Attack: malicious input in build logs (e.g., via public mailing list patches) triggers payload in viewer's browser.
- Payload can steal CSRF tokens, resubmit builds, gain admin rights, and access deploy keys.
- Defenses include CSP, sanitization (SourceHut's fix), and code restructuring.
- Author reported to SourceHut security; Drew DeVault mitigated by auto-sanitizing output.
- Collaborated with ansi2html upstream to release versions 1.9.3 and 1.9.4 fixing the bug.
- Bug introduced in 2021, exploited on flagship instance from 2022, fixed in 2026.
- Author criticizes CVSS scoring and rates vulnerability as high/critical due to potential impact.
- Author made $0 from vulnerability research and seeks support via purchases or consulting.