SourceHut account takeover via build logs (XSS in ansi2html.py)
SourceHut account takeover via build logs (XSS in ansi2html.py) occurred due to a vulnerability in the ansi2html.py script. This script converts ANSI escape codes to HTML, allowing for automatic links and OSC 8 hyperlinks. An attacker could craft a malicious input string to inject an XSS payload into the job logs. This payload could be downloaded from an attacker's website and executed in any browser that views the job log.
The attacker could subsequently gain access to deploy keys and admin rights on the SourceHut platform. Defense against this vulnerability should involve restricting Content-Security-Policy and improving sanitization in the ansi2html.py script.
Written by urgent.news from Lobsters's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
