Post

Short thread about how I tripped and fell on a $1500 Cursor auth bypass (mostly because burp suite is rad)

A couple days ago I proxied all my system traffic through burp suite pro to look at another app. I'm fairly sloppy when I work in burp and didn't have a scope or any filters set so I was seeing everything proxy (It's super interesting traffic and if you've never done it you should)

Burp tossed up one of these bad boys at me while I was attempting to abuse the Cursor Al agent to do research on the other target and the domain associated to this finding was for api2.cursor.sh - burp had my attention.

To generate a valid JWT for another user all we need is the other users auth user id. Not something that is necessarily going to be public or easily obtainable but something that is not out of the realm of being phished or being leaked in logs.

So l went to GitHub and searched for Cursor AND "authO user_" and managed to at least find one to prove a point... 😅

I also discovered that not only was it possible to forge these JWTs using a weak secret but some routes did not require a JWT to be present at all and only required the Cursor user id