Recap of the Lemmy XSS incident & steps for mitigation
Recap of the Lemmy XSS incident & steps for mitigation
UPDATE: The latest RC version of Lemmy-ui (0.18.2-rc.2) contains fixes for the issue, but if you believe you were vulnerable, you should still rotate your JWT secret after upgrading! Read below for instructions. Removing custom emoji is no longer necessary after upgrading.
Original post follows:
This post is intended as a central place that admins can reference regarding the XSS incident from this morning.
What happened?
A couple of the bigger Lemmy instances had several user accounts compromised through stolen authentication cookies. Some of these cookies belonged to admins, these admin cookies were used to deface instances. Only users that opened pages with malicious content during the incident were vulnerable. The malicious content was possible due to a bug with rendering custom emojis.
Stolen cookies gave attackers access to all private messages and e-mail addresses of affected users.
Am I vulnerable?
If your instance has ANY custom emojis, you are vulnerable. Note that it appears only local custom emojis are affected, so federated content with custom emojis from other instances should be safe.
I had custom emojis on my instance, what should I do?
This should be enough to mitigate now:
- Remove custom emoji
DELETE FROM custom_emoji_keyword;
DELETE FROM custom_emoji;
- Rotate your JWT secret (invalidates all current login sessions)
-- back up your secret first, just in case
SELECT * FROM secret;
-- generate a new secret
UPDATE secret SET jwt_secret = gen_random_uuid();
- Restart Lemmy server
If you need help with any of this, you can reach out to me on Matrix (@sunaurus:matrix.org) or on Discord (@sunaurus)
Legal
If your instance was affected, you may have some legal obligations. Please check this comment for more info: https://lemmy.world/comment/1064402
More context:
You're viewing a single thread.
It seems to me that the scope of this could have been mitigated with a simple privilege separation policy for admin server accounts but I see a lot of (what looks like) server admins using that account as their daily driver.
Also, lemmy-ui should post a security advisory to their github.
Welp, that is some simple lapse of separation-of-duties principles that shouldn't have been.
I don't pretend to know the demographics of lemmy server admins, but my gut says it's predominantly hobbyists and devops types, rather than grizzled system admins.
People in DevOps should know better than reusing their accounts. It doesn't take a seasoned system admin to know about basic OPSEC and separation amongst profiles.
Agreed. I'm pointing it out in hopes that becomes one of the takeaways of this incident.
(Unrelated, why are you marked at a bot account?)
Wait, why am I marked as a bot account?
This is the first time I've heard about this. Whom should I ask for help?
It's a checkbox in the setting for your account. You should be able to change it.
Hi, could you check now?
I still see it.