full-disclosure - Re: [FD] Security Advisory: Multiple High-Severity Vulnerabilities in Suno.com (JWT Leakage, IDOR, DoS)

Open Source and information security mailing list archives

Message-ID: <CAAnPYQ5CAY=e-4J=5hxR8oOBs+h41UBdgvF9UpzMepXxYsLJPg@mail.gmail.com>
Date: Tue, 14 Oct 2025 10:32:47 +0200
From: Gynvael Coldwind <gynvael@...dwind.pl>
To: Christopher Dickinson <chris.dickinson@...lfence.com>
Cc: fulldisclosure@...lists.org
Subject: Re: [FD] Security Advisory: Multiple High-Severity Vulnerabilities
 in Suno.com (JWT Leakage, IDOR, DoS)

>
> Finding 1: Excessive Data Exposure / JWT Token Leakage
>

> Attack Vector
>
> 1. User authenticates normally to suno.com
> 2. Malicious browser extension monitors network traffic
> 3. Extension intercepts API response from
> /v1/client/sessions/{session_id}/touch
> 4. Attacker extracts JWT token from JSON response body
> 5. Attacker uses stolen JWT to hijack victim’s session in separate
> browser/device
>    No user interaction required beyond normal application usage.
>

Vendor Response Pattern
> Finding 1: Dismissed due to misunderstanding of client-side risk.
>

Hi Christopher,

Vendor is correct with this one. The problem isn't the vendor's site – it's
that the browser is already pwned with the malicious browser extension
(this is site-agnostic).
You've mentioned "No user interaction required beyond normal application
usage.", but having "Malicious browser extension" installed is anything but
normal application usage.

This is not a vulnerability – this is how computers work.

One more note is that CVEs aren't (or at least should not be) assigned to
services. They are for software which folks can download and install on
their own systems, and which they have to maintain and patch themselves.

Best regards,
Gynvael
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives