Recap of the Lemmy XSS incident & steps for mitigation (lemm.ee)

submitted 1 year ago* (last edited 1 year ago) by sunaurus@lemm.ee to c/lemmy_admin@lemmy.ml

12 comments fedilink hide all child comments

UPDATE: The latest RC version of Lemmy-ui (0.18.2-rc.2) contains fixes for the issue, but if you believe you were vulnerable, you should still rotate your JWT secret after upgrading! Read below for instructions. Removing custom emoji is no longer necessary after upgrading.

Original post follows:

This post is intended as a central place that admins can reference regarding the XSS incident from this morning.

What happened?

A couple of the bigger Lemmy instances had several user accounts compromised through stolen authentication cookies. Some of these cookies belonged to admins, these admin cookies were used to deface instances. Only users that opened pages with malicious content during the incident were vulnerable. The malicious content was possible due to a bug with rendering custom emojis.

Stolen cookies gave attackers access to all private messages and e-mail addresses of affected users.

Am I vulnerable?

If your instance has ANY custom emojis, you are vulnerable. Note that it appears only local custom emojis are affected, so federated content with custom emojis from other instances should be safe.

I had custom emojis on my instance, what should I do?

This should be enough to mitigate now:

Remove custom emoji

DELETE FROM custom_emoji_keyword;
DELETE FROM custom_emoji;

Rotate your JWT secret (invalidates all current login sessions)

-- back up your secret first, just in case
SELECT * FROM secret;
-- generate a new secret
UPDATE secret SET jwt_secret = gen_random_uuid();

Restart Lemmy server

If you need help with any of this, you can reach out to me on Matrix (@sunaurus:matrix.org) or on Discord (@sunaurus)

Legal

If your instance was affected, you may have some legal obligations. Please check this comment for more info: https://lemmy.world/comment/1064402

More context:

https://github.com/LemmyNet/lemmy-ui/issues/1895

https://github.com/LemmyNet/lemmy-ui/pull/1897

all 14 comments

sorted by: hot top controversial new old

[-] PunchEnergy@lemmy.dbzer0.com 0 points 1 year ago

How did the hackers get the cookies in the first place? Compromised devices on the clients?

[-] devnill@lemmy.world -1 points 1 year ago

🅴🆁🅶🆈 1•

How did the hackers get the cookies in the first place? Compromised devices on the clients?

I'm not affiliated with lemmy.world or any other instance but I do software and can explain some of the jargon above. XSS is the abbreviation of one of the most common attacks we see on websites, cross-site scripting. This attack works by having some vulnerable code which arbitrarily executes some javascript on a users browser.

In this case, the attacker seems to have found a vulnerability where a specially crafted character is executed when users read posts or comments containing it. In this case, it was especially bad because of how passwords are stored. When you log in to pretty much any website, passwords are stored in the form of cookies; small pieces of data that are passed back and forth to the web server and the client automatically. Usually, these cookies are set to not be readable by javascript, but in this case, it appears that that flag was not set. This allowed the XSS exploit to be sent back to a computer which was set up to grab these cookies.

One thing to note is that although the cookies were stolen, our passwords wouldn't have immediately been compromised. Our login cookies store jwt tokens; a cryptographically signed message proving that we provided a password previously. That's not to say that further escalation isn't possible, but its hard to say for certain how far the hack went before being noticed.

[-] tko@tkohhh.social 0 points 1 year ago* (last edited 1 year ago)

I'm curious why the UI update to 0.18.2-rc.1 isn't mentioned anywhere in this thread. I understood that updating the UI was a fix for this exploit.

[-] db0@lemmy.dbzer0.com 0 points 1 year ago

Thanks for posting. There really should be a button which allows the admins to log everyone out for crisis situations like there I think

[-] MarcellusDrum@lemmy.ml 1 points 1 year ago

Changing the JWT secret does this. So instead of a button, its a line of code, making it less likely to be done by mistake.

[-] fututio_enjoyer@lemmy.world 0 points 1 year ago

Stolen cookies gave attackers access to all private messages

Aren't "private messages" not really private on lemmy anyway?

[-] sunaurus@lemm.ee 1 points 1 year ago* (last edited 1 year ago)

Under normal circumstances, they are only visible to:

sender (and whoever has DB access on the sender's instance)
recipient (and whoever has DB access on the recipient's instance)
in case a private message is reported, all admins of the reporter's instance

It is still considered a breach of user data if such messages are leaked.

[-] A_Random_Idiot@lemmy.world 0 points 1 year ago

"private" messages are not private anywhere.

[-] pfannkuchen_gesicht@lemmy.one 1 points 1 year ago

unless they're E2EE

[-] SeeJayEmm@lemmy.procrastinati.org 0 points 1 year ago

It seems to me that the scope of this could have been mitigated with a simple privilege separation policy for admin server accounts but I see a lot of (what looks like) server admins using that account as their daily driver.

Also, lemmy-ui should post a security advisory to their github.

this post was submitted on 10 Jul 2023

4 points (100.0% liked)

Lemmy Administration

686 readers

1 users here now

Anything about running your own Lemmy instance. Including how to install it, maintain and customise it.

Be sure to check out the docs: https://join-lemmy.org/docs/en/administration/administration.html

If you have any problems, describe them here and we will try to help you fixing them.

founded 4 years ago

MODERATORS

nutomic@lemmy.ml