you are being redirected to a porn site. sorry for the convenience.
this post was submitted on 10 Jul 2023
75 points (100.0% liked)
Fediverse
8 readers
2 users here now
This magazine is dedicated to discussions on the federated social networking ecosystem, which includes decentralized and open-source social media platforms. Whether you are a user, developer, or simply interested in the concept of decentralized social media, this is the place for you. Here you can share your knowledge, ask questions, and engage in discussions on topics such as the benefits and challenges of decentralized social media, new and existing federated platforms, and more. From the latest developments and trends to ethical considerations and the future of federated social media, this category covers a wide range of topics related to the Fediverse.
founded 1 year ago
it's also preventing all other content and (hopefully) temporarily killing the instance, I know you're probably just joking but this ain't good
oh hell no, I mean heck no, this is totally bad news bears. They just got clowned and if you don't laugh at yourself someone will do it for you.
I used to watch porn. I still do, but I used to, too.
Looks like Lemmy code has a security vulnerability, persistent XSS, that allows injection of Javascript into the sidebar and comments. That allowed the attacker to force load NSFW content even after lemmy.world admins cleaned up the first attack.
Looks like the injected JS code also steals login tokens from your browser, seems some admin accounts got compromised this way.
Probably a good idea to not visit Lemmy sites for time being (or block execution of Javascript in your browser, which is always a good idea).
Not just sidebar or comments, but anywhere markdown is used. The issue is the markdown editor. This is the current proposed fix.
Issue 1895 opened and patch purposed for the core issue. The markdown editor does no escaping input on custom emojis. This is likely why users on app were seeing text and not getting the redirect.
🙃
If you build it, they will come (to break it).
Takes me back to the myspace days.
The self-replicating javascript friend-adding worm! I remember that.
Any recommendations on how to mitigate risks like this when it comes to browsing lemmy? Any lite version to see lemmy through without Javascript?
No. The existing Lemmy-Lite that was advertised on join-Lemmy.org appears to be massively out of date, and no longer actively maintained.
It was a bug with Lemmy-UI, so you might be able to get away using an app or site that isn't vulnerable. Whether that is Wefwef, one of the apps, like Jerboa, or something that is Federated, but not Lemmy, like Kbin, or Mastodon (things might be a bit clunky if you do, since Lemmy threads aren't well handled by Mastodon).
view more: next ›