Conversation

Notices

1. Embed this notice
   on-lain ✔ᵛᵉʳᶦᶠᶦᵉᵈ (lain@lain.com)'s status on Saturday, 27-May-2023 03:37:03 JST on-lain ✔ᵛᵉʳᶦᶠᶦᵉᵈ
   So my current evaluation of this is:
   
   1. There's a bug in pleroma oembed parsing that allows html injection, this is probably the one used for the attack on poast. You need to have rich media (i.e. website previews) enable for that to be dangerous.
   
   2. There's a second exploit that I found first, having to with the CSP settings for /proxy. The nginx snippet i posted fixes that, but it doesn't fix the first issue.
   
   The used exploit might have been a different one altogether, but at least these two can absolutely be used to steal your oauth tokens.
   
   So what you should do in my opinion is to deactivate rich media and add the nginx snippet i posted. If you can, you should also implement alex's suggestion of moving media and proxy to subdomains (see here: https://gleasonator.com/notice/AW3PsTi4WCWEUbN0uO), as this will fix these two issues plus potential additional ones that we don't know of yet.
   
   you should also delete ALL oauth tokens, at least if you have used rich media or media proxy. you can do this by entering `delete from oauth_tokens` in psql.
   • Fediverse Contractor likes this.
   • Embed this notice
     on-lain ✔ᵛᵉʳᶦᶠᶦᵉᵈ (lain@lain.com)'s status on Saturday, 27-May-2023 03:50:51 JST on-lain ✔ᵛᵉʳᶦᶠᶦᵉᵈ

     in reply to

     • voltrina :shranny: :verifiedabkhazia:
     @voltrina i don't know
   • Embed this notice
     voltrina :shranny: :verifiedabkhazia: (voltrina@cybercriminal.eu)'s status on Saturday, 27-May-2023 03:50:52 JST voltrina :shranny: :verifiedabkhazia:

     in reply to
     @lain will moving media to a subdomain break existing attachments or?
   • Embed this notice
     on-lain ✔ᵛᵉʳᶦᶠᶦᵉᵈ (lain@lain.com)'s status on Saturday, 27-May-2023 04:39:57 JST on-lain ✔ᵛᵉʳᶦᶠᶦᵉᵈ

     in reply to

     • Your New Marijuana Injecting Waifu :weed:
     @sjw i'm not sure what you're trying to do, generally a lot is possible but it might involve redirects
   • Embed this notice
     Your New Marijuana Injecting Waifu :weed: (sjw@bae.st)'s status on Saturday, 27-May-2023 04:39:58 JST Your New Marijuana Injecting Waifu :weed:

     in reply to
     @lain is there a way I can have my media be served on root domain and just have media_proxy also proxy my own media on a subdomain?