this post was submitted on 10 Jul 2023
118 points (93.4% liked)
Lemmy.World Announcements
29065 readers
3 users here now
This Community is intended for posts about the Lemmy.world server by the admins.
Follow us for server news π
Outages π₯
https://status.lemmy.world
For support with issues at Lemmy.world, go to the Lemmy.world Support community.
Support e-mail
Any support requests are best sent to [email protected] e-mail.
Report contact
- DM https://lemmy.world/u/lwreport
- Email [email protected] (PGP Supported)
Donations π
If you would like to make a donation to support the cost of running this platform, please do so at the following donation URLs.
If you can, please use / switch to Ko-Fi, it has the lowest fees for us
Join the team
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
don't turn into reddit admins now, please answer this lol
Give them some time to investigate maybe?
Here's what I think happened: https://lemmy.world/comment/1059957
Basically it's Javascript that was injected in the main sidebar. That means that Lemmy doesn't escape HTML in the main sidebar (what about community sidebars?) and that Lemmy devs need to prioritize a security audit of the whole code base right now, I did this kind of shit when I was a kid and it's just insane that Lemmy has this vulnerability, this was not some sophisticated hack.
What it also means is that it's very unlikely that any personal data was compromised.
If you are right do you know what are the potential impacts of the vulnerability, what could a malicious individual do?
Hopefully not handling this many users without a comprehensive security audit!
Cookies were likely obtained too, so they could have logged into your account using those cookies and gotten your email address or posted something with your account, but I think it's more likely they prioritized admin accounts as they were also sending a flag indicating whether the account is an admin or not. Ruud's has invalidated those cookies a while ago so they're worthless now and the hacker can't use them to log in. See ruud's announcement.
It's looks like an admin account got compromised.
Yes that's what allowed them to modify the contents of the sidebar, but the more serious problem is that you can put HTML in the sidebar and it won't be escaped by the Lemmy backend. That's what allowed this JavaScript redirection.
Should also be pointed out the admin is evidently still compromised. The one that posted this thread.
I'm opening Pandora's box: what if all sidebars, not just the main one, have this vulnerability? An admin account being compromised will be the least of our worries if this is the case.
https://github.com/LemmyNet/lemmy-ui/issues/1895
Hope you got that energy for the rest of Lemmy instances because they're all the same
Aviate, navigate, comunΓcate... Give them time to solve the issue.