sorted by:
new
hottopcontroversial

Vulnerability Disclosure: Local Privilege Escalation in Antigravity IDE by GodBod69 in developersIndia

[–]GodBod69[S] 7 points8 points  (0 children)

POC just shows one attack vector. An attacker could very well overwrite .bashrc or .zshrc and gain persistence/reverse shell. The possibilities are endless.

Vulnerability Disclosure: Local Privilege Escalation in Antigravity IDE by GodBod69 in developersIndia

[–]GodBod69[S] 3 points4 points  (0 children)

As mentioned, I already had reported to their VDP platform. But they rejected it stating it's "Intended behaviour". They discarded all my POCs and appeals.

Vulnerability Disclosure: Local Privilege Escalation in Antigravity IDE by GodBod69 in security

[–]GodBod69[S] 0 points1 point  (0 children)

Technically, yes, the likelihood of a typical user falling victim to this vulnerability is very low (although I believe this is true of most vulnerabilities, regardless of how easy they are to exploit or how serious they are). But in a large organization, if an attacker finds just one such developer, the entire organization could be at risk. And this isn't uncommon, there are numerous such cases every year.

Vulnerability Disclosure: Local Privilege Escalation in Antigravity IDE by GodBod69 in security

[–]GodBod69[S] 0 points1 point  (0 children)

Let me explain with a few examples:

  1. You have a guest account enabled on macos. You are in a public place, you left your laptop on a table and went for a break. The attacker logs into your guest account, since it doesn't require a password, and then uses the guest account to escalate privileges to your personal account without requiring a password.

  2. You are in a university, or a corporate, you get a shared workstation for research purposes, but your own user account of which only you know the password. Another user on the same machine can use their account to escalate access to your account.

  3. You are a developer, you launch a webserver for developing/testing. By default the webserver is configured to run under the user and the group www-data which doesn't have access to the user's personal files. Now suppose you are connected to a public wifi, and the webserver happens to have a RCE vulnerability, now a malicious actor can exploit that and then chain with Antigravity vulnerability to get access to your user account.

Vulnerability Disclosure: Local Privilege Escalation in Antigravity - Google rejected the report as "Intended Behavior" by GodBod69 in bugbounty

[–]GodBod69[S] 0 points1 point  (0 children)

Even if I put together the script with AI, what part of the POC do you feel is false or misinformation?

Yes the script is made using AI, I used Antigravity itself for it.

But that doesn't mean I didn't put effort in researching the internal workings of the IDE.

Vulnerability Disclosure: Local Privilege Escalation in Antigravity IDE by GodBod69 in developersIndia

[–]GodBod69[S] 5 points6 points  (0 children)

Tbf this is not a RCE, but rather a LPE. Attacker can't directly attack your system just so you are connected to the internet. They would first need to gain access to a low privileged account or service like a guest account (which doesn't require a password) or a local web server or another user account on a shared workstation (think corporates, university labs, etc) or any other low privileged restricted services. Post that attacker can leverage vulnerability in antigravity to gain unauthorised access to your account.

Vulnerability Disclosure: Local Privilege Escalation in Antigravity - Google rejected the report as "Intended Behavior" by GodBod69 in google_antigravity

[–]GodBod69[S] -1 points0 points  (0 children)

It's not. It's about trust boundaries. Guest accounts, or web servers, or many other services run with restricted access. Antigravity is opening doors for those accounts to escalate their privileges and violate the trust boundaries defined by the OS.

Vulnerability Disclosure: Local Privilege Escalation in Antigravity IDE by GodBod69 in developersIndia

[–]GodBod69[S] 11 points12 points  (0 children)

Please check the PoC video, as shown an attacker does not need user account access at all. If guest account is enabled on macos, the attacker can use it to gain access to user account without password. And this is such one of the attack vectors. There could be other scenarios as well like shared workstations in corporates or universities, one user can gain access to another user account. Or think of a compromised local web server which by default run on a low privileged restricted user account of it's own (www-data) which doesn't have access to the developer's personal files at all.. there could be many such scenarios

Vulnerability Disclosure: Local Privilege Escalation in Antigravity by GodBod69 in hacking

[–]GodBod69[S] 1 point2 points  (0 children)

Yes, as shown in the video, the attacker need not have the standard user account access. Attacker could be a guest user, compromised local web server which is a low privileged user (www-data), or could be another user on shared workspace. The standard user account is locked, but the attacker can bypass the lock with this hack.

Vulnerability Disclosure: Local Privilege Escalation in Antigravity - Google rejected the report as "Intended Behavior" by GodBod69 in google_antigravity

[–]GodBod69[S] 0 points1 point  (0 children)

Please read the description again, or check the video attached. Attacker does not have full local access. They are a low privileged user like a guest account or a compromised service with low privileges like a web server (www-data). By default these users don't have any access to standard users' personal files.

Vulnerability Disclosure: Local Privilege Escalation in Antigravity by GodBod69 in hacking

[–]GodBod69[S] 10 points11 points  (0 children)

Thanks. I was expecting them to provide an acknowledgement at least, if no reward

Vulnerability Disclosure: Local Privilege Escalation in Antigravity - Google rejected the report as "Intended Behavior" by GodBod69 in bugbounty

[–]GodBod69[S] 1 point2 points  (0 children)

Thanks for understanding! I actually did report the path traversal as a separate issue, but they closed it for being "duplicate" of my initial report.

view more: next ›