Re: Security Advisory: Multiple High-Severity Vulnerabilities in Suno.com (JWT Leakage, IDOR, DoS)

[Gynvael Coldwind <gynvael () coldwind pl>]

> Finding 1: Excessive Data Exposure / JWT Token Leakage


> Attack Vector
>
> 1. User authenticates normally to suno.com
> 2. Malicious browser extension monitors network traffic
> 3. Extension intercepts API response from
> /v1/client/sessions/{session_id}/touch
> 4. Attacker extracts JWT token from JSON response body
> 5. Attacker uses stolen JWT to hijack victim’s session in separate
> browser/device
>    No user interaction required beyond normal application usage.

Vendor Response Pattern
> Finding 1: Dismissed due to misunderstanding of client-side risk.

Hi Christopher,

Vendor is correct with this one. The problem isn't the vendor's site – it's
that the browser is already pwned with the malicious browser extension
(this is site-agnostic).
You've mentioned "No user interaction required beyond normal application
usage.", but having "Malicious browser extension" installed is anything but
normal application usage.

This is not a vulnerability – this is how computers work.

One more note is that CVEs aren't (or at least should not be) assigned to
services. They are for software which folks can download and install on
their own systems, and which they have to maintain and patch themselves.

Best regards,
Gynvael
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/