{"id":1042,"date":"2026-04-23T12:05:00","date_gmt":"2026-04-23T05:05:00","guid":{"rendered":"https:\/\/vncybers.vn\/vercel-bi-tan-cong-chuoi-cung-ung-qua-lo-hong-oauth-tu-nha-cung-cap-ai\/"},"modified":"2026-04-23T21:26:40","modified_gmt":"2026-04-23T14:26:40","slug":"vercel-bi-tan-cong-chuoi-cung-ung-qua-lo-hong-oauth-tu-nha-cung-cap-ai","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/vercel-bi-tan-cong-chuoi-cung-ung-qua-lo-hong-oauth-tu-nha-cung-cap-ai\/","title":{"rendered":"Vercel b\u1ecb t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng qua l\u1ed7 h\u1ed5ng OAuth t\u1eeb nh\u00e0 cung c\u1ea5p AI"},"content":{"rendered":"
\"Vercel<\/figure>\n\n\n\n

Vercel, n\u1ec1n t\u1ea3ng cloud hosting \u0111\u01b0\u1ee3c h\u00e0ng tri\u1ec7u l\u1eadp tr\u00ecnh vi\u00ean s\u1eed d\u1ee5ng \u0111\u1ec3 tri\u1ec3n khai \u1ee9ng d\u1ee5ng web, v\u1eeba x\u00e1c nh\u1eadn \u0111\u00e3 b\u1ecb x\u00e2m ph\u1ea1m trong m\u1ed9t cu\u1ed9c t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng ph\u1ee9c t\u1ea1p. \u0110i\u1ec3m kh\u1edfi \u0111\u1ea7u kh\u00f4ng ph\u1ea3i t\u1eeb h\u1ea1 t\u1ea7ng c\u1ee7a Vercel m\u00e0 t\u1eeb m\u1ed9t c\u00f4ng ty AI \u0111\u1ed1i t\u00e1c: Context AI.<\/p>\n\n\n\n

Hacker chi\u1ebfm Google Workspace qua OAuth c\u1ee7a Context AI<\/h2>\n\n\n\n

S\u1ef1 c\u1ed1 b\u1eaft \u0111\u1ea7u t\u1eeb th\u00e1ng 3 n\u0103m 2026, khi Context AI b\u1ecb x\u00e2m ph\u1ea1m th\u00f4ng qua \u1ee9ng d\u1ee5ng Office Suite d\u00e0nh cho ng\u01b0\u1eddi d\u00f9ng c\u00e1 nh\u00e2n. \u1ee8ng d\u1ee5ng n\u00e0y cho ph\u00e9p k\u1ebft n\u1ed1i v\u00e0 t\u1ef1 \u0111\u1ed9ng h\u00f3a t\u00e1c v\u1ee5 gi\u1eefa nhi\u1ec1u n\u1ec1n t\u1ea3ng kh\u00e1c nhau th\u00f4ng qua c\u01a1 ch\u1ebf OAuth.<\/p>\n\n\n\n

M\u1ed9t nh\u00e2n vi\u00ean c\u1ee7a Vercel \u0111\u00e3 c\u00e0i \u0111\u1eb7t \u1ee9ng d\u1ee5ng n\u00e0y v\u00e0 k\u1ebft n\u1ed1i v\u1edbi t\u00e0i kho\u1ea3n Google doanh nghi\u1ec7p. Khi Context AI b\u1ecb hack, hacker chi\u1ebfm \u0111\u01b0\u1ee3c OAuth token c\u1ee7a ng\u01b0\u1eddi d\u00f9ng, trong \u0111\u00f3 c\u00f3 token c\u1ee7a nh\u00e2n vi\u00ean Vercel. T\u1eeb \u0111\u00e2y, h\u1ecd leo thang quy\u1ec1n truy c\u1eadp v\u00e0o h\u1ec7 th\u1ed1ng n\u1ed9i b\u1ed9 c\u1ee7a Vercel th\u00f4ng qua Google Workspace.<\/p>\n\n\n\n

D\u1eef li\u1ec7u kh\u00e1ch h\u00e0ng b\u1ecb \u0111\u00e1nh c\u1eafp, API key b\u1ecb l\u1ed9<\/h2>\n\n\n\n

Sau khi ki\u1ec3m so\u00e1t \u0111\u01b0\u1ee3c t\u00e0i kho\u1ea3n n\u1ed9i b\u1ed9, hacker truy c\u1eadp v\u00e0o c\u00e1c h\u1ec7 th\u1ed1ng ch\u1ee9a th\u00f4ng tin x\u00e1c th\u1ef1c kh\u00f4ng \u0111\u01b0\u1ee3c m\u00e3 h\u00f3a. Theo tuy\u00ean b\u1ed1 c\u1ee7a Vercel, ph\u1ea1m vi \u1ea3nh h\u01b0\u1edfng c\u00f3 th\u1ec3 l\u00ean t\u1edbi “h\u00e0ng tr\u0103m ng\u01b0\u1eddi d\u00f9ng thu\u1ed9c nhi\u1ec1u t\u1ed5 ch\u1ee9c kh\u00e1c nhau”.<\/p>\n\n\n\n

M\u1ed9t t\u00e1c nh\u00e2n \u0111e d\u1ecda tr\u00ean di\u1ec5n \u0111\u00e0n t\u1ed9i ph\u1ea1m m\u1ea1ng tuy\u00ean b\u1ed1 \u0111ang rao b\u00e1n d\u1eef li\u1ec7u g\u1ed3m API key, m\u00e3 ngu\u1ed3n v\u00e0 d\u1eef li\u1ec7u c\u01a1 s\u1edf d\u1eef li\u1ec7u c\u1ee7a kh\u00e1ch h\u00e0ng Vercel v\u1edbi m\u1ee9c gi\u00e1 2 tri\u1ec7u \u0111\u00f4 la. Nh\u00f3m hacker ShinyHunters b\u1ecb n\u00eau t\u00ean trong v\u1ee5 n\u00e0y nh\u01b0ng \u0111\u00e3 ph\u1ee7 nh\u1eadn li\u00ean quan.<\/p>\n\n\n\n

CEO Vercel, Guillermo Rauch, khuy\u1ebfn c\u00e1o kh\u00e1ch h\u00e0ng n\u00ean thay th\u1ebf (rotate) t\u1ea5t c\u1ea3 API key v\u00e0 th\u00f4ng tin x\u00e1c th\u1ef1c trong c\u00e1c d\u1ef1 \u00e1n tri\u1ec3n khai, \u0111\u1eb7c bi\u1ec7t nh\u1eefng key \u0111\u01b0\u1ee3c \u0111\u00e1nh d\u1ea5u l\u00e0 non-sensitive. Vercel kh\u1eb3ng \u0111\u1ecbnh c\u00e1c d\u1ef1 \u00e1n m\u00e3 ngu\u1ed3n m\u1edf Next.js v\u00e0 Turbopack kh\u00f4ng b\u1ecb \u1ea3nh h\u01b0\u1edfng.<\/p>\n\n\n\n

T\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng ng\u00e0y c\u00e0ng nh\u1eafm v\u00e0o h\u1ea1 t\u1ea7ng AI<\/h2>\n\n\n\n

\u0110i\u1ec3m \u0111\u00e1ng lo ng\u1ea1i kh\u00f4ng ch\u1ec9 l\u00e0 quy m\u00f4 thi\u1ec7t h\u1ea1i m\u00e0 c\u00f2n l\u00e0 vector t\u1ea5n c\u00f4ng. Context AI l\u00e0 c\u00f4ng ty cung c\u1ea5p c\u00f4ng c\u1ee5 \u0111\u00e1nh gi\u00e1 v\u00e0 ph\u00e2n t\u00edch hi\u1ec7u n\u0103ng m\u00f4 h\u00ecnh AI, m\u1ed9t lo\u1ea1i d\u1ecbch v\u1ee5 ng\u00e0y c\u00e0ng ph\u1ed5 bi\u1ebfn trong h\u1ec7 sinh th\u00e1i ph\u00e1t tri\u1ec3n ph\u1ea7n m\u1ec1m. Khi c\u00e1c t\u1ed5 ch\u1ee9c t\u00edch h\u1ee3p s\u00e2u h\u01a1n v\u1edbi c\u00e1c nh\u00e0 cung c\u1ea5p AI \u0111\u1ec3 ph\u00e2n t\u00edch, gi\u00e1m s\u00e1t v\u00e0 t\u1ed1i \u01b0u h\u00f3a h\u1ec7 th\u1ed1ng, b\u1ec1 m\u1eb7t t\u1ea5n c\u00f4ng qua chu\u1ed7i cung \u1ee9ng c\u0169ng m\u1edf r\u1ed9ng t\u01b0\u01a1ng \u1ee9ng.<\/p>\n\n\n\n

M\u00f4 h\u00ecnh t\u1ea5n c\u00f4ng n\u00e0y, x\u00e2m ph\u1ea1m nh\u00e0 cung c\u1ea5p ph\u1ea7n m\u1ec1m trung gian \u0111\u1ec3 t\u1eeb \u0111\u00f3 leo thang v\u00e0o kh\u00e1ch h\u00e0ng l\u1edbn h\u01a1n, \u0111\u00e3 li\u00ean ti\u1ebfp xu\u1ea5t hi\u1ec7n trong th\u1eddi gian g\u1ea7n \u0111\u00e2y v\u00e0 tr\u1edf th\u00e0nh m\u1ed9t trong nh\u1eefng chi\u1ebfn thu\u1eadt \u01b0a th\u00edch c\u1ee7a c\u00e1c nh\u00f3m hacker nh\u1eafm v\u00e0o c\u01a1 s\u1edf h\u1ea1 t\u1ea7ng c\u00f4ng ngh\u1ec7.<\/p>\n\n\n\n

B\u00e0i h\u1ecdc t\u1eeb v\u1ee5 vi\u1ec7c<\/h2>\n\n\n\n

V\u1ee5 Vercel l\u00e0m n\u1ed5i b\u1eadt m\u1ed9t \u0111i\u1ec3m y\u1ebfu c\u01a1 b\u1ea3n trong c\u00e1ch nhi\u1ec1u t\u1ed5 ch\u1ee9c qu\u1ea3n l\u00fd quy\u1ec1n truy c\u1eadp OAuth: kh\u00f4ng c\u00f3 c\u01a1 ch\u1ebf ki\u1ec3m so\u00e1t ch\u1eb7t ch\u1ebd c\u00e1c \u1ee9ng d\u1ee5ng b\u00ean th\u1ee9 ba \u0111\u01b0\u1ee3c nh\u00e2n vi\u00ean c\u1ea5p quy\u1ec1n v\u00e0o t\u00e0i kho\u1ea3n doanh nghi\u1ec7p. M\u1ed9t \u1ee9ng d\u1ee5ng ti\u00eau d\u00f9ng b\u00ecnh th\u01b0\u1eddng c\u00f3 th\u1ec3 tr\u1edf th\u00e0nh c\u1eeda sau v\u00e0o h\u1ec7 th\u1ed1ng n\u1ed9i b\u1ed9 n\u1ebfu OAuth token \u0111\u01b0\u1ee3c g\u00e1n cho t\u00e0i kho\u1ea3n c\u00f3 \u0111\u1ee7 \u0111\u1eb7c quy\u1ec1n.<\/p>\n\n\n\n

M\u1ed9t s\u1ed1 bi\u1ec7n ph\u00e1p c\u1ea7n xem x\u00e9t: ki\u1ec3m to\u00e1n \u0111\u1ecbnh k\u1ef3 danh s\u00e1ch \u1ee9ng d\u1ee5ng OAuth \u0111\u01b0\u1ee3c c\u1ea5p quy\u1ec1n v\u00e0o t\u00e0i kho\u1ea3n doanh nghi\u1ec7p, \u00e1p d\u1ee5ng nguy\u00ean t\u1eafc \u0111\u1eb7c quy\u1ec1n t\u1ed1i thi\u1ec3u (least privilege) cho m\u1ecdi k\u1ebft n\u1ed1i b\u00ean th\u1ee9 ba, v\u00e0 \u0111\u1ea3m b\u1ea3o kh\u00f4ng l\u01b0u tr\u1eef th\u00f4ng tin x\u00e1c th\u1ef1c quan tr\u1ecdng d\u01b0\u1edbi d\u1ea1ng plaintext trong b\u1ea5t k\u1ef3 h\u1ec7 th\u1ed1ng n\u00e0o.<\/p>\n\n\n\n

 <\/p>\n\n\n\n

VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb: TechCrunch, The Hacker News, tuy\u00ean b\u1ed1 ch\u00ednh th\u1ee9c c\u1ee7a Vercel v\u00e0 Context AI<\/em><\/p>","protected":false},"excerpt":{"rendered":"

N\u1ec1n t\u1ea3ng cloud hosting Vercel x\u00e1c nh\u1eadn b\u1ecb x\u00e2m ph\u1ea1m sau khi hacker chi\u1ebfm quy\u1ec1n Google Workspace c\u1ee7a nh\u00e2n vi\u00ean th\u00f4ng qua OAuth token b\u1ecb \u0111\u00e1nh c\u1eafp t\u1eeb nh\u00e0 cung c\u1ea5p AI Context AI.<\/p>","protected":false},"author":2,"featured_media":1041,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[89,90,88,87,20],"class_list":["post-1042","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc","tag-bao-mat-dam-may","tag-context-ai","tag-oauth","tag-tan-cong-chuoi-cung-ung","tag-vercel"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1042","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1042"}],"version-history":[{"count":2,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1042\/revisions"}],"predecessor-version":[{"id":1073,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1042\/revisions\/1073"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1041"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1042"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1042"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1042"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}