lodion comments on (URGENT) Lemmy has an XSS vulnerability in the sidebar - sh.itjust.works

(URGENT) Lemmy has an XSS vulnerability in the sidebar - sh.itjust.works (sh.itjust.works)

submitted 3 years ago by eatham@sh.itjust.works to c/meta@aussie.zone

36 comments fedilink hide all child comments

https://sh.itjust.works/post/923025

you are viewing a single comment's thread
view the rest of the comments

[–] lodion@aussie.zone 11 points 3 years ago* (3 children)

I encourage everyone, but especially mods to enable 2FA on their account. I'll do up a post tonight with screenshots on exactly how to do this, I realise the lemmy process isn't as smooth as it could be. Ideally it would present a QR code to scan with with your phone as most other sites do.

hideshow 6 child comments

[–] Zagorath@aussie.zone 6 points 3 years ago (2 children)

Some points from the admin of ttrpg.network in our Discord chat:

the html injection seems not to apply to 18.1 (the version we're on) [us too!], but if it does, it applies to the sidebar, posts, and comments (so a huge deal)
apparently there's some concerns around the implementation (of 2fa) at the moment....maybe i'll just shut it off for now and wait then....

This thread explains the very serious risk of Lemmy's current 2FA implementation.

Real risk of locking yourself out of your account.

parent

hideshow 4 child comments

[–] lordriffington@aussie.zone 6 points 3 years ago

Yeah, 2fa didn't work for me when I tried to set it up. Was just lucky I was logged in on more than one browser, so I could go and disable it.

parent

[–] lodion@aussie.zone 4 points 3 years ago (1 child)

Real risk of locking yourself out of your account.

yes, the initial setup is not intuitive at all. Once setup it functions normally.

parent

hideshow 2 child comments

[–] maniacalmanicmania@aussie.zone 3 points 3 years ago (2 children)

Thanks. I'm going to wait for your guide. What do you advise we do with bot accounts?

parent

hideshow 4 child comments

[–] lodion@aussie.zone 4 points 3 years ago (2 children)

I've thrown this together.

parent

hideshow 4 child comments

[–] maniacalmanicmania@aussie.zone 3 points 3 years ago

Thanks. This worked. I got a little confused with points 3, 4 and 5 but now that I've re-read your instructions I see that they are clear and I have no suggestions for improving them at this time.

parent

[–] Gorgritch_umie_killa@aussie.zone 2 points 3 years ago (1 child)

Hey, so i followed the guide. I think i hit all the steps, but when i try to log in on the browser to test whether its worked. The 2fa box does come up. But when i enter the code and hit login theres no progression on from that screen. Not sure where i've gone wrong? Using Aegis btw.

parent

hideshow 2 child comments

[–] lodion@aussie.zone 2 points 3 years ago (1 child)

Hmm you may need to disable 2FA again. I'm not sure why it wouldn't work, perhaps Aegis hasn't imported it correctly?

parent

hideshow 2 child comments

[–] Gorgritch_umie_killa@aussie.zone 2 points 3 years ago

Okay cool, it just worked. No idea what difference waiting overnight made though.

parent

[–] lodion@aussie.zone 3 points 3 years ago

In the short term, use a 60 character password and never use that account interactively. ie only use it with your scripts/bot. And obviously keep the password securely stored.

parent

[–] RustyRaven@aussie.zone 3 points 3 years ago (1 child)

Mine just won't enable it at all. I have it set up on my other account, but this one when I hit save nothing happens.

parent

hideshow 2 child comments

[–] lodion@aussie.zone 3 points 3 years ago* (1 child)

That is one of the issues... if you tick the box to enable 2FA and hit save, you then need to hit F5/refresh for the '2FA Installation link' to appear.

Actually making use of the 2FA installation link is also not intuitive... as I said I'll try and post a sequence of screenshots tonight with a fresh test account to show the process.

parent

hideshow 2 child comments

[–] RustyRaven@aussie.zone 4 points 3 years ago (1 child)

That didn't work, but I have solved it. I had to take the emoji out of my display name. No idea why that has any impact, but it did.

parent

hideshow 2 child comments

[–] GloomyBagel@aussie.zone 4 points 3 years ago (2 children)

i’ll be damned if I’m removing my identity just to protect my account

parent

hideshow 4 child comments

[–] Treevan@aussie.zone 3 points 3 years ago (2 children)

Mine worked with emoji. You can continue to be you.

parent

hideshow 4 child comments

[–] RustyRaven@aussie.zone 3 points 3 years ago (1 child)

The 2FA system might just be prejudiced against birds. I tried putting it back in after it was set up and it won't save my settings if the emoji is there. It's very weird.

parent

hideshow 2 child comments

[–] Treevan@aussie.zone 1 point 3 years ago (1 child)

Can you move the bird to the back of your name and test?

parent

hideshow 2 child comments

[–] RustyRaven@aussie.zone 2 points 3 years ago (1 child)

It won't let me put it anywhere in the field. A bagel or a smiley face are find, but I can't do the bird, or a black cat. It might be something to do with the specific emoji - both the black bird and cat are a standard bird/cat paired with a black square which display as a single emoji on some systems.

parent

hideshow 2 child comments

[–] lodion@aussie.zone 1 point 3 years ago

At a guess your emoji is part of a a newer unicode table and something in the lemmy backend has an older version that doesn't include it.

parent

[–] GloomyBagel@aussie.zone 2 points 3 years ago

thank you, and the 2FA set up was actually the easiest i’ve ever set up on iOS. a little too easy …

parent

[–] RustyRaven@aussie.zone 3 points 3 years ago

I've been playing around and it's only some emojis it has a problem with. Your bagels are safe.

parent

[–] Aesecakes@lemmy.world 2 points 3 years ago (1 child)

I tried doing this but have lost access to my aussie.zone account (same user name). I checked the 2FA box but I couldn't see the extra setup steps (I think I refreshed the page), so I unchecked the box and saved. I then changed my pw. Now it seems to accept new pw but am getting incorrect 2FA token error. What do I do?

parent

hideshow 2 child comments

[–] lodion@aussie.zone 3 points 3 years ago (1 child)

Oh bugger. Sorry, I'll need to find out how to manually toggle 2FA on your account in the database. I won't be able to do this until I get home this evening.

parent

hideshow 2 child comments

[–] Aesecakes@lemmy.world 2 points 3 years ago (1 child)

Thanks in advance

parent

hideshow 2 child comments

[–] lodion@aussie.zone 2 points 3 years ago (1 child)

Try now... think I've disabled it on your aussie.zone account.

parent

hideshow 2 child comments

[–] Aesecakes@aussie.zone 2 points 3 years ago (1 child)

Thank you, that worked!

parent

hideshow 2 child comments

[–] lodion@aussie.zone 3 points 3 years ago (1 child)

Excellent 🙂

parent

hideshow 2 child comments

[–] cuppaconcrete@aussie.zone 1 point 3 years ago (1 child)

You are one of the best admins I've met in my coupla decades of internet usage. I love ya work mate and if you ever want a hand from a fellow sysadmin hit me up.

parent

hideshow 2 child comments

[–] lodion@aussie.zone 2 points 3 years ago

aww thanks 😇

parent