wake.st is one of the many independent Mastodon servers you can use to participate in the fediverse.
the personal instance of Liaizon Wakest

Administered by:

Server stats:

1
active users

ATTENTION LEMMY ADMINS: XSS VULNERABILITY NEEDS PATCHING

Details:
lemmy.world/post/1293336

Lemmy.world was hacked and most Lemmy servers are still vulnerable to the exploit:
lemmy.world/post/1290412

[posted also to @fediverse]

lemmy.worldRecap of the Lemmy XSS incident & steps for mitigation - LemmyWorldThis post is intended as a central place that admins can reference regarding the XSS incident from this morning. ### What happened? A couple of the bigger Lemmy instances had several user accounts compromised through stolen authentication cookies. Some of these cookies belonged to admins, these admin cookies were used to deface instances. Only users that opened pages with malicious content during the incident were vulnerable. The malicious content was possible due to a bug with rendering custom emojis. Stolen cookies gave attackers access to all private messages and e-mail addresses of affected users. ### Am I vulnerable? If your instance has ANY custom emojis, you are vulnerable. Note that it appears only local custom emojis are affected, so federated content with custom emojis from other instances should be safe. ### I had custom emojis on my instance, what should I do? This should be enough to mitigate now: 1. Remove custom emoji DELETE FROM custom_emoji_keyword; DELETE FROM custom_emoji; 2. Rotate your JWT secret (invalidates all current login sessions) -- back up your secret first, just in case SELECT * FROM secret; -- generate a new secret UPDATE secret SET jwt_secret = gen_random_uuid(); 3. Restart Lemmy server If you need help with any of this, you can reach out to me on Matrix (@sunaurus:matrix.org) or on Discord (@sunaurus) ### Legal If your instance was affected, you may have some legal obligations. Please check this comment for more info: https://lemmy.world/comment/1064402 [https://lemmy.world/comment/1064402] ##### More context: https://github.com/LemmyNet/lemmy-ui/issues/1895 [https://github.com/LemmyNet/lemmy-ui/issues/1895] https://github.com/LemmyNet/lemmy-ui/pull/1897 [https://github.com/LemmyNet/lemmy-ui/pull/1897]

This would be more relevant in !lemmy@lemmy.ml, although there’s already a post about it there.

@mondoman712 lemmy is part of the fediverse so it is relevant

cross-post it to !lemmy_support@lemmy.ml too.

You do it. It’s your post.

You do it. You should have posted it there.

I wasn’t being disrespectful. And thank you, it’s always fun to argue with a total stranger.

@liaizon is just not a very kind or reasonable person. It’s not you, it’s them.