- cross-posted to:
- cybersecurity@sh.itjust.works
- cross-posted to:
- cybersecurity@sh.itjust.works
I tried what another user reported and it worked. I submitted a github issue as the security email seems to be unmonitored based on me trying to contact it (regarding a different issue) for over a week now.
Be careful about links you click in Lemmy, I guess.
cross-posted from: https://sh.itjust.works/post/774797
What is XSS?
Cross-site scripting (XSS) is an exploit where the attacker attaches code onto a legitimate website that will execute when the victim loads the website. That malicious code can be inserted in several ways. Most popularly, it is either added to the end of a url or posted directly onto a page that displays user-generated content. In more technical terms, cross-site scripting is a client-side code injection attack. https://www.cloudflare.com/learning/security/threats/cross-site-scripting/
Impact
One-click Lemmy account compromise by social engineering users to click your posts URL.
Reproduction
Lemmy does not properly sanitize URI’s on posts leading to cross-site scripting. You can see this working in action by clicking the “link” attached to this post on the web client.
To recreate, simply create a new post with the URL field set to:
javascript:alert(1)//
Patching
Adding filtering to block
javascript:
anddata:
URI’s seems like the easiest approach.
Yeah this needs to be addressed ASAP.
While this is a critical issue, it makes me trust the platform even more, thanks to people like you who are committed to improving the security. So thanks for reporting this and hopefully it will be fixed as soon as possible 👌
Fixed 3 minutes ago… cool!Noice. Might need to let the Kbin dev know in case this affects them too
@ernest@kbin.social
hopefully that works?
What about Gemini and gopher links?
Shit this is baaaaaad
Is this how u/spez will take us down?
Jk. Commenting to show activity on the post.
jesus will protect me
May the Lord have mercy on us all.
Well. Fuck.
excellent find. well done!
Patching: Allow only beginning with https:// (and maybe http://) might avoid related issues with any other protocols that the various browsers support?
Agreed, I recommended filtering to only http(s) links in the github issue, I just made this x-post. I don’t see a strong reason to let people link to weird things like
file:
anddata:
, or deeplink to installed apps on your computer/phone. Filtering the scheme to just http(s) is how Nutomic seems to have fixed it in the backend from what I can tell (I am not a rust dev).