It Only Took 2 Characters  AWS SDK JavaScript v3 is perhaps one of the single most important and popular repositories on the internet there is. It runs on effectively every single cloud instance up in the cloud on AWS's kind of hosted service. If this were to be compromised like half of the Fortune 500 companies would be compromised along with it and someone actually figured out how to do it. Yikes. Now, just wait until you see this. Just like I actually just genuinely feel bad for cuz when you see it, you can't unsee it. It's just so obvious. Your heart goes out for the team, okay? Cuz it's such a simple mistake that I know for a fact that I would have made. Now, this particular bug uh once again involves cloud CI integration. And it kind of seems like the theme of the last 365 days have been, hey, you got a cloud CI, you probably got a vulnerability. And this one comes courtesy of course of AWS code build. Now, it's nothing that AWS code build it did itself. It's just configuration. Again, it's always it just feel it's just the same stuff every single time. There's a YAML file out there and it's going to ruin your company. Of course, for those that don't know anything about AWS Code Bill, it's a fully managed continuous integration service that compiles source code, run tests, and produces software packages that are ready to deploy. Thanks, AI. I appreciate that, old Gemini. You little rascal. Now, the most recent one that comes to mind from these CI vulnerabilities, of course, is the big singularity NX hack, where a simple echo statement of the PR's title allowed a hacker to gain control of the entire NX repository system and then release out malicious ones that would exfiltrate important tokens from users of said NX packages or even transcendentally using NX packages. Now, luckily this time, it's not shahalude or singularity just giving it to us. Instead, these were some white hat hackers who were able to just take control of the AWSJS SDK and were able to get admin rights and then have the whole thing fixed. Now, here's how it happened. Just like GitHub, this code build has this kind of like web hook thing that goes on in which you have like push and pull request created and pull request updated. All the same kind of hooks you would expect. And then right here it says actor ID and then you see this kind of list of actor IDs. Now, I already know some of you right away looked at that and went, "Oh my gosh." No. Please tell me it's not so. Please tell me it is not so. Yes, it is. So, it is that simple. Now, for the rest of us, if you if you really look at that list, like zoom in, okay, look at the list. Why would you ever separate a bunch of numbers with bars, right? Like, would you use commas? Well, yes. That's if you wanted a comma-epparated list. This is not a comma-epparated list. This is a reax. Now, me personally, I have my own kind of runin with the reax. You may look at this right here. This is the old Netflix TV signin. I accidentally added a reax way back in the day, like 10 years ago, where you could just keep on clicking at Gmail and you'd keep on getting more atgmails, but it said your email address was valid. Okay. I've personally been bit by rejaxes, so I cannot judge the fine folks over uh at this AWSJSSDKV3. All right, so for those that don't actually have any idea what's happening, let me just type this up really quickly for you. Okay, so I'm going go like this. Const a equals we have like 1 2 3 4 pipe 1337. So that is pretty much the exact same thing, right? It's a reax with the pipe separator saying, "Hey, either one of these numbers." Now I go like this a test and then I can put in something here like 1 2 3 4 and look that's true. If I put in 1 124 you'll notice oh no that's not correct. If I put in 1337 it is correct. 1338 though not correct. So where is the bug? Well it's as simple as this. You see that number? You think that passes the above check? Why yes it does. So that means the attackers just had to have an account ID on GitHub that had the at least the same subset of numbers. Their ID just simply had to contain one of these many IDs. And look at this one. 755743. That probably happens every now and then on GitHub. That's not even a very long number. So our fine friends over at Whiz.io, the ones who originally discovered this bug, what they did is this. They figured out it was kind of like a global race condition against GitHub. a new GitHub account every two GitHub accounts are created a second. And so all they had to do was wait until they got near an ID that appeared on that list and then they just created literally hundreds of accounts in that moment and boom, they got an account who had an ID who contained that submatch. Now you're probably thinking, okay, well what's the big deal? Wh why does that matter? Okay, you can run these CI jobs. What really actually matters with this? Well, here's the thing is a lot of these CI jobs, it's not the fact that you can run them that is the problem. It's that you get to choose what gets ran because in most of these environments, they have privileged GitHub tokens because they have to do things on behalf of GitHub. They have to close down PRs. They have to say yes, this can be merged. No, this can't be merged. Sometimes they allow for automerging from one branch to another. Second, there's all these npm tokens that NPM There we go. There, there, there it is. You have all these npm tokens that exist and that allows you to like push or delete or do whatever the heck goes on in npm these days. I don't think you can delete anymore, but you can do all this and push up your own version. So if you can control CI, theoretically I could add a new CI job or a set of tasks that need to be ran during CI in which goes into your process end gets all of the tokens from your pro process end and then sends it out to one of my own personal little clouds and I could go, "Oh, look at this. My little cloud my little cloud has all of your tokens and now I can use your tokens to get everything." Okay, now guess what? Now you're going to have to hide your kids, hide your wives, and hide your husbands because I'm out there taking everybody's tokens. And of course, this would allow me then to publish, say, my own versions of your SDK. And this is effectively exactly what happened with the singularity hack and NX is that all they had to do was get a hold of a running GitHub action. And once you get that, oh baby, you get those keys to the kingdom. And honestly, when I see this, I just feel so bad because of course it's a reax. It's always a reax. I swear there's just something so funny about the fact that it's always a reax. There are memes dedicated to the fact that it's always a reax. There was even a fun phrase during like 2014 2015 era over at Netflix where we used to say that 50% of all production bugs were in fact could be like traced back to a reax. It is always a reax. I don't know why. I don't know how. It's just they just always are there screwing your life over. Awesome article. You should go read about it. It's really really good. This is up on Whiz.io. And of course, there's a shorter version of just the tweet highlight reel if you want to go look at that. Links are in the description. Thanks for watching. The name is you're never going to catch me using a rejaxen. By the way, have you ever met people that call them regg? I mean, I actually agree with the fact that they probably should be called regex because it's a regular expression. regular expression reg x but some odd reason I just feel like they're called regaxes. Same with character versus char. Why do I call it a char? Shouldn't it be a car? A car star is the appropriate way to say a caricaturer pointer. I don't what is with what is wrong with me that I just have these I just decide some G's need to go J just like GitHub probably should be Jithub. I should you know honestly if I was honest with myself it'd just be called Jithub. Hey, is that HTTP? Get that out of here. That's not how we order coffee. We order coffee via SSH terminal.shop. Yeah, you want a real experience. You want real coffee. You want awesome subscriptions so you never have to remember again? Oh, you want exclusive blends with exclusive coffee and exclusive content? Then check out Kron. You don't know what SSH is? >> Well, maybe the coffee is not for you. in hand. Living the dream., It Only Took 2 Characters, YouTube, 01kfgbmxse9wrky1g5yhs5xj0v.