Found the error Not allowed to load local resource: file:///etc/passwd
while looking at infosec.pub’s communities page. There’s a community called “ignore me” that adds a few image tags trying to steal your passwd file.
You have to be extremely poorly configured for this to work, but the red flags you see should keep you on your toes for the red flags you don’t.
Is this, by any chance, originated from the sub called ignore
? In that case is probably my bad because is set as the image of the channel. (I was playing with lemmy in the previous version and forgot about it, sorry. It will not work since your browser can’t access local file that easily without breaking the sandbox :))
Edit: I removed it so you shouldn’t see the alert anymore. What I wasn’t expecting is that apparently every sub is loaded even if you don’t visit it.
But… why? Why even put that URL there? Even if it was most likely harmless for all users, this still looks like an attempt at data exfiltration.
I’ve had around 20 of ‘lol exploit’ queries in my instance. Luckily none of them succeeded.
I wonder if it is a bad actor or someone is trying to pentest Lemmy. If they were a bad actor wouldn’t they be more successful posting in a more popular community than “ignore me”?
Can confirm it’s still there for the ignore me
community.
While this is concerning, I wonder what the author(s) of this were thinking would happen. I assume it’s supposed to be an attempt at stealing the server’s passwords, since I at least know of no browser that freely allows access to local files.
FWIW, /etc/passwd
itself contains no passwords (the name exists for historical reasons) but it definitely is a globally accessible file that can give you clues about the target system. Given this, it’s more likely the user is attempting to find out if arbitrary disk reads are possible by using a well known path on many servers.