Found the error Not allowed to load local resource: file:///etc/passwd while looking at infosec.pub’s communities page. There’s a community called “ignore me” that adds a few image tags trying to steal your passwd file.
You have to be extremely poorly configured for this to work, but the red flags you see should keep you on your toes for the red flags you don’t.
I wonder if it is a bad actor or someone is trying to pentest Lemmy. If they were a bad actor wouldn’t they be more successful posting in a more popular community than “ignore me”?
Can confirm it’s still there for the ignore me community.
Nice share, thanks for the information. Definitely need to be careful both as a server operator with Lemmy, and a user of it.
Is this, by any chance, originated from the sub called ignore? In that case is probably my bad because is set as the image of the channel. (I was playing with lemmy in the previous version and forgot about it, sorry. It will not work since your browser can’t access local file that easily without breaking the sandbox :))
Edit: I removed it so you shouldn’t see the alert anymore. What I wasn’t expecting is that apparently every sub is loaded even if you don’t visit it.
But… why? Why even put that URL there? Even if it was most likely harmless for all users, this still looks like an attempt at data exfiltration.
I’ve had around 20 of ‘lol exploit’ queries in my instance. Luckily none of them succeeded.
