Cybersecurity

5872 readers

137 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Be respectful. Everyone should feel welcome here.
No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
No Ads / Spamming.
No pornography.

Community Rules

Idk, keep it semi-professional?
Nothing illegal. We're all ethical here.
Rules will be added/redefined as necessary.

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities [email protected] [email protected] [email protected] [email protected] [email protected]

Notable mention to [email protected]

founded 2 years ago

MODERATORS

[email protected]

Lemmy Security Vulnerability - Cross-Site Scripting via post URL's. ()

submitted 2 years ago* (last edited 2 years ago) by [email protected] to c/[email protected]

28 comments fedilink hide all child comments

What is XSS?

Cross-site scripting (XSS) is an exploit where the attacker attaches code onto a legitimate website that will execute when the victim loads the website. That malicious code can be inserted in several ways. Most popularly, it is either added to the end of a url or posted directly onto a page that displays user-generated content. In more technical terms, cross-site scripting is a client-side code injection attack. https://www.cloudflare.com/learning/security/threats/cross-site-scripting/

Impact

One-click Lemmy account compromise by social engineering users to click your posts URL.

Reproduction

Lemmy does not properly sanitize URI's on posts leading to cross-site scripting. You can see this working in action by clicking the "link" attached to this post on the web client.

To recreate, simply create a new post with the URL field set to: javascript:alert(1)//

Patching

Adding filtering to block javascript: and data: URI's seems like the easiest approach.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 3 points 2 years ago (3 children)

Does the default CSP do anything to mitigate this?

https://github.com/LemmyNet/lemmy-ui/blob/9ce164245f51b834997f31f3f12497ee87474965/src/server/middleware.ts#L12

[–] [email protected] 2 points 2 years ago (2 children)

I believe if unsafe-inline were removed from script-src then the CSP would block this.

If the frontend depends on inline script tags then this likely can't be changed super easily... The fact that unsafe-eval is in script-src is kinda worrying as well. Ideally you would lock the CSP down a lot more than they have.

[–] [email protected] 0 points 2 years ago (1 children)

Aye, I am pretty sure CSP is bypass-able in most situations unless your pinning checksums or hashes. Just thought it might help take the edge off the hacker panic.

[–] [email protected] 1 points 2 years ago

Yeah, it can certainly help in some cases, defense in depth and all that. If the CSP were 'self' (allowing any JS hosted on your domain) this would probably be DoA. Sadly, until the frontend stops using <script> to set things on window to hydrate state from SSR to client-side they won't be able to change it without breaking things.