23
(URGENT) Lemmy has an XSS vulnerability in the sidebar - sh.itjust.works (sh.itjust.works)
submitted 3 years ago by to c/meta@aussie.zone
36 comments fedilink hide all child comments
 

https://sh.itjust.works/post/923025

you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 3 years ago (2 children)

Some points from the admin of ttrpg.network in our Discord chat:

  • the html injection seems not to apply to 18.1 (the version we're on) [us too!], but if it does, it applies to the sidebar, posts, and comments (so a huge deal)
  • apparently there's some concerns around the implementation (of 2fa) at the moment....maybe i'll just shut it off for now and wait then....

This thread explains the very serious risk of Lemmy's current 2FA implementation.

Real risk of locking yourself out of your account.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 4 points 3 years ago (1 child)

    Real risk of locking yourself out of your account.

    yes, the initial setup is not intuitive at all. Once setup it functions normally.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 3 years ago (2 children)

    Thanks. I'm going to wait for your guide. What do you advise we do with bot accounts?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 4 points 3 years ago (2 children)

    I've thrown this together.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 3 years ago (1 child)

    Hey, so i followed the guide. I think i hit all the steps, but when i try to log in on the browser to test whether its worked. The 2fa box does come up. But when i enter the code and hit login theres no progression on from that screen. Not sure where i've gone wrong? Using Aegis btw.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •