SourceHut account takeover via build logs (XSS in ansi2html.py)
Stored XSS in SourceHut's ansi2html can run script from CI build logs and enable account takeover.
A researcher disclosed a cross-site scripting flaw in SourceHut's ansi2html.py, which converts ANSI codes in builds.sr.ht job logs into HTML. Weak escaping of OSC 8 hyperlink sequences lets attacker-controlled log output inject script that runs when someone views the build page. Logs can be poisoned without a paid account via a public mailing list with CI, or by controlling output printed during a build. Injected script can read the page CSRF token and, if an administrator views the log, could seek admin rights and SourceHut deploy keys. The author opened an issue and a pull request; no CVE or in-the-wild exploitation is reported.
- OSC 8 hyperlink parsing in ansi2html.py fails to escape attacker-controlled URLs.
- Poisoned build logs can be created via public mailing lists with CI.
- Viewing a malicious log runs script that can read the CSRF token.
- An admin viewer could expose SourceHut deploy keys and admin access.
- Issue and pull request filed; no CVE or confirmed exploitation.
- Vendors
- SourceHut
- Products
- builds.sr.htansi2html
- Organizations
- SourceHut
From the original article
11 min read at blog.arusekk.plI like good stories, so let me describe some background first. I recently had a ‘great’ idea (I know, I know, I should stop having these) to set up a sr. ht instance You can find it shamelessly plugged in the timeline section,
By blog.arusekk.pl via winter · blog.arusekk.pl
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.