Muse 修复共享 artifact 链接可被被动 DNS 发现的漏洞
An update on @Muse shared artifacts.
Muse 修复了共享 artifact 的设计缺陷：部分共享 artifact 的 URL 可通过被动 DNS 被发现，团队已立即关闭分享功能并在修复后恢复。修复前分享的 artifact 已更换新 URL，访问旧链接会提示向分享者索取新链接；Muse 澄清该问题只涉及共享 artifact，不涉及聊天分享。Muse 漏洞赏金计划对有效报告最高奖励 30 万美元。
正文
An update on @Muse shared artifacts.
Earlier this week, a security researcher published details of a design flaw in @Muse shared artifacts: some shared artifact URLs were discoverable via passive DNS. We disabled sharing immediately to prevent any unintended exposure, which is why shared artifacts were temporarily unavailable. Some articles we have seen in the press mentioned a flaw in chat sharing, and that is not the case - this issue was specifically about shared artifacts.
The underlying issue is now fixed, and sharing is back on.
If you shared an artifact before the fix: it now has a new URL. Anyone visiting the old link will see a note asking them to get the new one from you. We know that's a pain, and we're sorry for the disruption — but protecting user data has to come first.
We're grateful to the researchers who find and report issues like this. The Muse bug bounty program exists so these reports can reach us directly and responsibly, with awards of up to $300,000 for valid findings. Every report is reviewed. If you find something, please send it our way.