What is XSS?

Cross-site scripting (XSS) is an exploit where the attacker attaches code onto a legitimate website that will execute when the victim loads the website. That malicious code can be inserted in several ways. Most popularly, it is either added to the end of a url or posted directly onto a page that displays user-generated content. In more technical terms, cross-site scripting is a client-side code injection attack. https://www.cloudflare.com/learning/security/threats/cross-site-scripting/

Impact

One-click Lemmy account compromise by social engineering users to click your posts URL.

Reproduction

Lemmy does not properly sanitize URI’s on posts leading to cross-site scripting. You can see this working in action by clicking the “link” attached to this post on the web client.

To recreate, simply create a new post with the URL field set to: javascript:alert(1)//

Patching

Adding filtering to block javascript: and data: URI’s seems like the easiest approach.

  • terribleplan@lemmy.nrd.li
    link
    fedilink
    English
    arrow-up
    3
    arrow-down
    1
    ·
    edit-2
    1 year ago

    OP is just quoting me there I think. If they aren’t quoting me then they did try to contact the developer…

    • Dusty@l.dustybeer.com
      link
      fedilink
      English
      arrow-up
      4
      arrow-down
      1
      ·
      1 year ago

      Typical reasonable disclosure is in terms months usually, not “nearly a week”. OP is being irresponsible at best by posting this before giving time to the developers to see, and act on it.

      • terribleplan@lemmy.nrd.li
        link
        fedilink
        English
        arrow-up
        9
        arrow-down
        4
        ·
        edit-2
        1 year ago

        I mean, a dialogue over months, maybe. Over a week of hearing nothing even saying they got your email and are looking into it is pretty bad on the part of the lemmy devs IMO. The “responsibility” part of responsible disclosure goes both ways. Also, this is incredibly low effort to find. This isn’t even XSS really, it’s just a complete lack of link filtering.

        • Dusty@l.dustybeer.com
          link
          fedilink
          English
          arrow-up
          6
          arrow-down
          1
          ·
          1 year ago

          The “responsibility” part of responsible disclosure goes both ways

          It absolutely does, it also means following up, not “They didn’t reply in a week so instead of trying other ways to contact them, I’m just going to post about it”. They didn’t even try to open an issue because they “don’t use github” all while coming here talking about how bad the vulnerability is.

          It’s poor (lack of) judgement on OP’s part.

        • Zagorath
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 year ago

          It’s not great from either side here, really. Precise guidelines for responsible disclosure vary, but none would ever say “go public after trying to contact the developers once and not hearing back for a week”.

          ZDI’s policy says that after 5 days they attempt contact again. After another 5 days, they’ll try any intermediaries or other ways of contacting they can think of up until 15 days after the initial contact. If at any point before that, the developers acknowledge the problem, ZDI gives up to 120 days to resolve the problem (from date of acknowledgement). They imply (without having a specific policy laid out) that more time will be given beyond that if it’s reasonably needed.

          All of OP’s comments have been deleted so I don’t know what they tried exactly, but it certainly seems like they didn’t try hard enough. It also seems like Lemmy’s devs may not have been responsive enough. Ideally, they would have a /.well-known/security.txt file with an email address that is actively monitored explicitly for security disclosures. Failing that, whatever public method they do have for contact that OP used, assuming it was a mode of communication that could reasonably be expected to be monitored, should have been monitored.

          I actually don’t think that GitHub is an appropriate place to be doing security vulnerability disclosures. GitHub might not be user-facing, but it’s still public. You can maybe put something in there essentially as a way to tag “hey, be on the lookout for a real disclosure”, but any actual details should not be on GitHub. In this case, if the email didn’t work, OP should have posted something on GitHub saying “hey, major security flaw, please check your email for details”. If OP really doesn’t want to use GitHub, they should have requested someone else do that on their behalf—maybe via a sufficiently vague post on Lemmy. What’s absolutely clear that they should not have done, is gone public with all the details based on a single attempt at emailing and one week of waiting.

          • terribleplan@lemmy.nrd.li
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 year ago

            Yeah, OPs responses weren’t clear whether they tried to contact the devs or not, how, and how many times.

            RD is great and all, but I do understand people not following it. It isn’t anyone’s obligation to spend their free time trying to get someone else to fix their vulnerable software. Having something just dropped publicly like this sucks, but IMO knowing about it is better than the alternative of malicious actors are exploiting it despite someone having noticed it and not saying anything.

            Github is where the equivalent of /.well-known/security.txt lives (which is an interesting/potentially difficult concept for open source/federated software), and specifies an email to contact with security concerns. I have been emailed since sharing this vuln via a github issue and asking them to email me so I can disclose a different security issue. They alsso apparently discuss this on matrix as well which I am being invited to.

            Also, thankfully in this case the devs were on the ball and got a fix in a few hours ago. It seems like the fix for this will be in 0.18…1, which is hopefully pretty close to release (first rc was a bit over a week ago).

            • Zagorath
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 year ago

              RD is great and all, but I do understand people not following it. It isn’t anyone’s obligation to spend their free time trying to get someone else to fix their vulnerable software.

              As far as I’m concerned, if you can’t be bothered to go through some fairly basic steps to disclose it responsibly, you shouldn’t be calling yourself a “security researcher”. It’s not an excuse for doing an irresponsible disclosure. That’s just…irresponsible.

              In this case I think it can be forgiven because it’s a problem that can fairly easily be mitigated by individual users, and also by admins and community mods, but I don’t think it’s a good thing to promote as a general rule.

              • terribleplan@lemmy.nrd.li
                link
                fedilink
                English
                arrow-up
                1
                ·
                1 year ago

                “Responsible disclosure” (which apparently is more commonly called “Coordinated disclosure” now) vs “Full disclosure” has been a debate among security researchers for as long as I can remember, so I have to respectfully disagree.