Cybersecurity

6383 readers

221 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Be respectful. Everyone should feel welcome here.
No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
No Ads / Spamming.
No pornography.

Community Rules

Idk, keep it semi-professional?
Nothing illegal. We're all ethical here.
Rules will be added/redefined as necessary.

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !securitynews@infosec.pub !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub

Notable mention to !cybersecuritymemes@lemmy.world

founded 2 years ago

MODERATORS

kid@sh.itjust.works

Lanky_Pomegranate530@midwest.social

Lemmy Security Vulnerability - Cross-Site Scripting via post URL's. ()

submitted 2 years ago* (last edited 2 years ago) by 1337@sh.itjust.works to c/cybersecurity@sh.itjust.works

28 comments fedilink hide all child comments

What is XSS?

Cross-site scripting (XSS) is an exploit where the attacker attaches code onto a legitimate website that will execute when the victim loads the website. That malicious code can be inserted in several ways. Most popularly, it is either added to the end of a url or posted directly onto a page that displays user-generated content. In more technical terms, cross-site scripting is a client-side code injection attack. https://www.cloudflare.com/learning/security/threats/cross-site-scripting/

Impact

One-click Lemmy account compromise by social engineering users to click your posts URL.

Reproduction

Lemmy does not properly sanitize URI's on posts leading to cross-site scripting. You can see this working in action by clicking the "link" attached to this post on the web client.

To recreate, simply create a new post with the URL field set to: javascript:alert(1)//

Patching

Adding filtering to block javascript: and data: URI's seems like the easiest approach.

you are viewing a single comment's thread
view the rest of the comments

[–] terribleplan@lemmy.nrd.li 2 points 2 years ago* (last edited 2 years ago) (4 children)

OP is just quoting me there I think. If they aren't quoting me then they did try to contact the developer...

[–] Dusty@l.dustybeer.com 2 points 2 years ago (3 children)

Typical reasonable disclosure is in terms months usually, not "nearly a week". OP is being irresponsible at best by posting this before giving time to the developers to see, and act on it.

[–] terribleplan@lemmy.nrd.li 4 points 2 years ago* (last edited 2 years ago) (2 children)

I mean, a dialogue over months, maybe. Over a week of hearing nothing even saying they got your email and are looking into it is pretty bad on the part of the lemmy devs IMO. The "responsibility" part of responsible disclosure goes both ways. Also, this is incredibly low effort to find. This isn't even XSS really, it's just a complete lack of link filtering.

[–] Dusty@l.dustybeer.com 4 points 2 years ago

The “responsibility” part of responsible disclosure goes both ways

It absolutely does, it also means following up, not "They didn't reply in a week so instead of trying other ways to contact them, I'm just going to post about it". They didn't even try to open an issue because they "don't use github" all while coming here talking about how bad the vulnerability is.

It's poor (lack of) judgement on OP's part.

load more comments (1 replies)