this post was submitted on 10 Jul 2023
181 points (99.5% liked)

Feddit UK

1347 readers
1 users here now

Community for the Feddit UK instance.
A place to log issues, and for the admins to communicate with everyone.

founded 1 year ago
MODERATORS
181
submitted 1 year ago* (last edited 1 year ago) by tom to c/feddituk
 

So last night a XSS scripting attack was found on all Lemmy instances. See the lemmy world update here https://feddit.uk/post/453040

What this means is that hackers could inject their own "script" when any user viewed a comment/post that the hackers made. The hackers would then grab your JWT token with the script so they could impersonate that user. (And perform any actions on behalf of the user)

Luckily, it looks like I haven't been compromised so the site config should all be the same

What has been done about this

I've removed any comments or posts which included the script see here https://github.com/LemmyNet/lemmy-ui/issues/1895

I would have removed all custom emojis as well but there was none in our DB, this may potentially mean that this site was not affected. Just in case, I've also rotated the JWT tokens so all tokens are now invalid. This means you will have to logout and log back into the instance

Shoutout to @clara@feddit.uk for messaging me about this and bringing it to my attention

you are viewing a single comment's thread
view the rest of the comments
[–] Digestive_Biscuit 5 points 1 year ago* (last edited 1 year ago) (3 children)

Great job!

I don't know if it's related. Since today when I login to the Jerboa app then try to post or close/reopen the app my account for feddit.uk disappears from the app. I have to keep logging in.

[–] Cyber 2 points 1 year ago

Just to say, mine seems ok after closing and reopening the app... but I'll check again later.

[–] fakeman_pretendname 2 points 1 year ago (1 children)

You may need to clear the cache and data for Jerboa on your phone first, then log back in.

[–] Digestive_Biscuit 1 points 1 year ago

Thanks for the tip. I just tried that, didn't work. So I then I deleted all data and that did! It meant I had to login to all my accounts again but it seems to be working.

[–] Noodle_lover 1 points 1 year ago

Same issue for me. Also using Jerboa.