this post was submitted on 06 Jul 2023
22 points (95.8% liked)

Discussions related to Infosec.pub

1128 readers
1 users here now

founded 1 year ago
MODERATORS
jerry@infosec.pub
22
Lemmy Security Vulnerability: XSS In the Wild (sh.itjust.works)
submitted 1 year ago* (last edited 1 year ago) by henfredemars@infosec.pub to c/infosecpub@infosec.pub
8 comments fedilink hide all child comments
 

Be careful what posts you click until this is patched.

EDIT: Clarify, this server I expect is also vulnerable, hence the choice of community.

you are viewing a single comment's thread
view the rest of the comments
[–] henfredemars@infosec.pub 8 points 1 year ago* (last edited 1 year ago)

Deleting the post might have been damage control because the disclosure was not responsible. Details are in the project GitHub, but basically it's possible to trick Lemmy into serving injected JavaScript by making a post with a crafted URL.

This could allow a user to compromise the accounts of other users if you can get them to click on your post.