What is XSS?

Cross-site scripting (XSS) is an exploit where the attacker attaches code onto a legitimate website that will execute when the victim loads the website. That malicious code can be inserted in several ways. Most popularly, it is either added to the end of a url or posted directly onto a page that displays user-generated content. In more technical terms, cross-site scripting is a client-side code injection attack. https://www.cloudflare.com/learning/security/threats/cross-site-scripting/

Impact

One-click Lemmy account compromise by social engineering users to click your posts URL.

Reproduction

Lemmy does not properly sanitize URI’s on posts leading to cross-site scripting. You can see this working in action by clicking the “link” attached to this post on the web client.

To recreate, simply create a new post with the URL field set to: javascript:alert(1)//

Patching

Adding filtering to block javascript: and data: URI’s seems like the easiest approach.

  • terribleplan@lemmy.nrd.liEnglish
    1·
    1 year ago

    Yeah, OPs responses weren’t clear whether they tried to contact the devs or not, how, and how many times.

    RD is great and all, but I do understand people not following it. It isn’t anyone’s obligation to spend their free time trying to get someone else to fix their vulnerable software. Having something just dropped publicly like this sucks, but IMO knowing about it is better than the alternative of malicious actors are exploiting it despite someone having noticed it and not saying anything.

    Github is where the equivalent of /.well-known/security.txt lives (which is an interesting/potentially difficult concept for open source/federated software), and specifies an email to contact with security concerns. I have been emailed since sharing this vuln via a github issue and asking them to email me so I can disclose a different security issue. They alsso apparently discuss this on matrix as well which I am being invited to.

    Also, thankfully in this case the devs were on the ball and got a fix in a few hours ago. It seems like the fix for this will be in 0.18…1, which is hopefully pretty close to release (first rc was a bit over a week ago).

    • ZagorathEnglish
      1·
      1 year ago

      RD is great and all, but I do understand people not following it. It isn’t anyone’s obligation to spend their free time trying to get someone else to fix their vulnerable software.

      As far as I’m concerned, if you can’t be bothered to go through some fairly basic steps to disclose it responsibly, you shouldn’t be calling yourself a “security researcher”. It’s not an excuse for doing an irresponsible disclosure. That’s just…irresponsible.

      In this case I think it can be forgiven because it’s a problem that can fairly easily be mitigated by individual users, and also by admins and community mods, but I don’t think it’s a good thing to promote as a general rule.

      • terribleplan@lemmy.nrd.liEnglish
        1·
        1 year ago

        “Responsible disclosure” (which apparently is more commonly called “Coordinated disclosure” now) vs “Full disclosure” has been a debate among security researchers for as long as I can remember, so I have to respectfully disagree.