I tried what another user reported and it worked. I submitted a github issue as the security email seems to be unmonitored based on me trying to contact it (regarding a different issue) for over a week now.

Be careful about links you click in Lemmy, I guess.

cross-posted from: https://sh.itjust.works/post/774797

What is XSS?

Cross-site scripting (XSS) is an exploit where the attacker attaches code onto a legitimate website that will execute when the victim loads the website. That malicious code can be inserted in several ways. Most popularly, it is either added to the end of a url or posted directly onto a page that displays user-generated content. In more technical terms, cross-site scripting is a client-side code injection attack. https://www.cloudflare.com/learning/security/threats/cross-site-scripting/

Impact

One-click Lemmy account compromise by social engineering users to click your posts URL.

Reproduction

Lemmy does not properly sanitize URI’s on posts leading to cross-site scripting. You can see this working in action by clicking the “link” attached to this post on the web client.

To recreate, simply create a new post with the URL field set to: javascript:alert(1)//

Patching

Adding filtering to block javascript: and data: URI’s seems like the easiest approach.

  • DevNull
    link
    fedilink
    English
    171 year ago

    While this is a critical issue, it makes me trust the platform even more, thanks to people like you who are committed to improving the security. So thanks for reporting this and hopefully it will be fixed as soon as possible 👌

  • s4if
    link
    fedilink
    English
    131 year ago

    commit to fix this
    Fixed 3 minutes ago… cool!

    • 𝒍𝒆𝒎𝒂𝒏𝒏
      link
      English
      51 year ago

      Noice. Might need to let the Kbin dev know in case this affects them too

      @ernest@kbin.social

      hopefully that works?

  • @perviouslyiner@lemm.ee
    link
    fedilink
    English
    11 year ago

    Patching: Allow only beginning with https:// (and maybe http://) might avoid related issues with any other protocols that the various browsers support?

    • terribleplanOP
      link
      fedilink
      English
      51 year ago

      Agreed, I recommended filtering to only http(s) links in the github issue, I just made this x-post. I don’t see a strong reason to let people link to weird things like file: and data:, or deeplink to installed apps on your computer/phone. Filtering the scheme to just http(s) is how Nutomic seems to have fixed it in the backend from what I can tell (I am not a rust dev).