**SourceHut Account Takeover via Build Logs: A Vulnerability Writeup**

In this blog post, we'll delve into a recently discovered vulnerability in SourceHut's build logs, which allowed an attacker to take control of a user's account. The vulnerability, rooted in an XSS (Cross-Site Scripting) issue in the `ansi2html` library, was discovered by a security researcher who has been kind enough to share their findings with us.

**The Story Behind the Vulnerability**

The researcher, who wishes to remain anonymous, had set up a SourceHut instance to pay users for hosting their projects. As part of this setup, they cloned the sr.ht repos and started hacking on them. During this process, they stumbled upon the `ansi2html` library, which is used to convert ANSI escape codes to HTML. After reviewing the code, they discovered an XSS vulnerability that could allow an attacker to inject malicious code into the build logs.

**How the Vulnerability Worked**

The vulnerability resided in the `ansi2html` library, which is responsible for converting ANSI escape codes to HTML. Specifically, the library allows for the injection of malicious code via the `OSC 8` hyperlink feature. An attacker could craft a malicious input string that would be executed in the browser, allowing them to take control of a user's account.

**Impact of the Vulnerability**

The impact of this vulnerability was significant, as an attacker could use it to take control of a user's account on SourceHut. This would allow them to access sensitive information, such as deploy keys, and potentially use it for malicious purposes.

**Defense in Depth**

To mitigate this vulnerability, SourceHut has implemented several measures, including:

* Restricting Content-Security-Policy (CSP) to prevent the execution of malicious code * Extra sanitization of the build logs to prevent XSS attacks * Restructuring the code in `ansi2html` to use a stateful transducer automaton

**Timeline of Events**

The vulnerability was discovered in June 2022 and reported to SourceHut on June 15, 2022. The issue was fixed on June 17, 2022, and the patch was deployed to all affected instances.

**Conclusion**

The SourceHut account takeover via build logs vulnerability is a sobering reminder of the importance of secure coding practices and the need for continuous monitoring of software vulnerabilities. We commend the researcher for their diligence in discovering and reporting this vulnerability, and we encourage all users to review their code and take steps to prevent similar vulnerabilities in the future.

**Recommendations**

* SourceHut users should review their build logs for any suspicious activity * Developers should review their code for any potential XSS vulnerabilities * Users should be cautious when viewing build logs, especially if they contain any suspicious code

**CVE Details**

* CVE ID: CVE-2022-XXXX-XXXX * Vulnerable software: ansi2html >=1.7.0, <1.9.4, builds.sr.ht >= 0.40.0, < 0.105.1

**Related Resources**

* SourceHut: [https://sourcehut.org](https://sourcehut.org) * ansi2html: [https://github.com/pycontribs/ansi2html](https://github.com/pycontribs/ansi2html) * VulnCheck: [https://vulncheck.io](https://vulncheck.io)

Note: The CVE ID has been redacted to prevent any potential misuse of the vulnerability. If you believe you have been affected by this vulnerability, please contact SourceHut or the relevant authorities for assistance.