Public
- Public
- Network
- Groups
- Featured
- Popular
- People

Conversation

Notices

Embed this notice
ilja (ilja@ilja.space)'s status on Monday, 29-May-2023 22:03:33 JST ilja
- Oneesan succubus
For Akkoma peeps who host their media on the same domain as akkoma-fe, see this post from @lain
I also made a post on the forum about it https://meta.akkoma.dev/t/another-vector-for-the-injection-vulnerability-found/483

RE: https://pleroma.soykaf.com/objects/3b39ef1b-194e-44ec-b726-b8d83a478961
In conversation Monday, 29-May-2023 22:03:33 JST from ilja.space permalink
Attachments
1. Domain not in remote thumbnail source whitelist: meta.akkoma.dev
  
  Another vector for the injection vulnerability found
  
  See Pleroma/Soykaf As you all probably know (if not, see the comments in https://meta.akkoma.dev/t/akkoma-stable-2023-05-baked-beans-and-spam/475/8), there has recently been discovered an injection vulnerability in Akkoma-fe. Both Pleroma and Akkoma are affected by it. Some fixes have already been done do mitigate this issue, but yet another attack vector has been found. From what I understand, the vulnerability allows remote code execution with code being injected through media. When that med...
2. Untitled attachment
- on-lain ✔ᵛᵉʳᶦᶠᶦᵉᵈ likes this.

Feeds