4 ms·

Ask HN: Is Lemmy Suffering an Exploit?

10 points by urda 3y ago

Lemmy might be suffering from an XSS attack [1]. It looks like a few major groups are impacted [2] [3] [4]. It seems odd for them to all suffer admin credentials leaking at the same time. [1] https://lemmy.ml/post/1896249 [2] https://beehaw.org [3] https://lemmy.blahaj.zone/ [4] https://lemmy.world/

deleted 3y ago
[deleted]
tivi 3y ago
beehaw.org is down, but how do you know they were affected?
- urda 3y ago
  Not 100% sure, but the timing is odd no?
  - tivi 3y ago
    They took it down preemptively.
    - urda 3y ago
      So yeah, seems to have a large impact all the same.
xyst 3y ago
Can see the code injected by spammers/attackers as well: https://programming.dev/post/532566 https://programming.dev/post/532566 One commenter mentions http cookies are used in lemmy. Not familiar with code base so I can’t confirm. So if true then this attack shouldn’t have caused such a widespread outage. Something else might be going on
pulsartwin 3y ago
Looks like it was due to unsafe processing of custom emoji: https://github.com/LemmyNet/lemmy-ui/pull/1897 https://github.com/LemmyNet/lemmy-ui/pull/1897