UPDATE: The latest RC version of Lemmy-ui (0.18.2-rc.2) contains fixes for the issue, but if you believe you were vulnerable, you should still rotate your JWT secret after upgrading! Read below for instructions. Removing custom emoji is no longer necessary after upgrading.
Original post follows:
This post is intended as a central place that admins can reference regarding the XSS incident from this morning.
What happened?
A couple of the bigger Lemmy instances had several user accounts compromised through stolen authentication cookies. Some of these cookies belonged to admins, these admin cookies were used to deface instances. Only users that opened pages with malicious content during the incident were vulnerable. The malicious content was possible due to a bug with rendering custom emojis.
Stolen cookies gave attackers access to all private messages and e-mail addresses of affected users.
Am I vulnerable?
If your instance has ANY custom emojis, you are vulnerable. Note that it appears only local custom emojis are affected, so federated content with custom emojis from other instances should be safe.
I had custom emojis on my instance, what should I do?
This should be enough to mitigate now:
- Remove custom emoji
DELETE FROM custom_emoji_keyword;
DELETE FROM custom_emoji;
- Rotate your JWT secret (invalidates all current login sessions)
-- back up your secret first, just in case
SELECT * FROM secret;
-- generate a new secret
UPDATE secret SET jwt_secret = gen_random_uuid();
- Restart Lemmy server
If you need help with any of this, you can reach out to me on Matrix (@sunaurus:matrix.org) or on Discord ()
Legal
If your instance was affected, you may have some legal obligations. Please check this comment for more info: https://lemmy.world/comment/1064402
More context:
Thanks for posting. There really should be a button which allows the admins to log everyone out for crisis situations like there I think
Changing the JWT secret does this. So instead of a button, its a line of code, making it less likely to be done by mistake.
True as that is, not every admin has DB access and those with DB access might be AFK.
Surely this exploit proves that it’s best to minimise the number of administrative actions available in the UI?
In crisis situations like this, the last thing you want is to rely on some portion of the application UI working.
If the UI doesn’t work, there’s always the DB directly. But it’s good to have that option.
JWT secret keys are not in the DB (speaking typically, maybe for Lemmy they are, but that would be very surprising), that’s typically an environment variable or configuration file sort of thing.
In any case, this isn’t the part that’s broken, it doesn’t need fixed.
It seems to me that the scope of this could have been mitigated with a simple privilege separation policy for admin server accounts but I see a lot of (what looks like) server admins using that account as their daily driver.
Also, lemmy-ui should post a security advisory to their github.
Welp, that is some simple lapse of separation-of-duties principles that shouldn’t have been.
I don’t pretend to know the demographics of lemmy server admins, but my gut says it’s predominantly hobbyists and devops types, rather than grizzled system admins.
People in DevOps should know better than reusing their accounts. It doesn’t take a seasoned system admin to know about basic OPSEC and separation amongst profiles.
I still wouldn’t use the admin account as my daily driver. Leave it open in another browser/private tab specifically to perform admin actions (as noted) but not for browsing/posting/community modding. I understand how that’s a pain but given how early days we are with this platform and the high probability of more issues surfacing, it’s a necessary pain.
I’d really like to see the devs add some tools to mitigate future risk and further protect admin accounts. The least of which being that admin actions require stronger validation than a browser side cookie, and frequent re-validation to perform admin actions.
I still wouldn’t use the admin account as my daily driver. Leave it open in another browser/private tab specifically to perform admin actions
i’ve thought about switching to a different account for non-admin tasks but I was a normal user here first and I want to keep using this account for normal posting too. I think using a different account is kind of pointless from a security standpoint, because performing mod and admin actions requires looking at user-generated content anyway and there is no way around that (except for maybe moving to a very clipboard-heavy workflow which would make everything take much longer).
There is work underway to fix these XSS bugs in a more comprehensive way (better CSP, and HttpOnly cookies…) which will hopefully land soon.
(i am not a lemmy developer but i’m reading the github and matrix chat…)
This bug also needs to be fixed so that a user logging out / changing password actually correctly invalidates their JWT token: https://github.com/LemmyNet/lemmy/issues/3364
I suspect that last night even if an admin knew their account was compromised, they probably couldn’t do anything about it without DB access.
This bug also needs to be fixed so that a user logging out / changing password actually correctly invalidates their JWT token: https://github.com/LemmyNet/lemmy/issues/3364
Okay it is insane that that issue is 2 weeks old and was not prioritized.
I love Lemmy and am grateful for the work of the devs. But I see huge issues with the LemmyNet governance.
Previously it was captchas that were removed because one of the two main devs had a strong personal belief that captchas are “useless” and wanted to impose that belief upon everyone, which then led to an enormous wave of bots with the 0.18.0 as captchas were removed. I’m glad he was then convinced that he was wrong to remove them and then took steps to revert that decision, but it took too long and many instances suffered performance problems by being forced to stay with the 0.17.6 version because it had captchas.
Right now the same thing happens again with issues about security being left unanswered for two weeks. I believe right now all feature developments should be paused and a security audit of the whole code base should be the #1 priority.
This is just very bad. Proper governance and prioritization would have avoided exposing minors to lemon party porn and other disgusting content.
Thanks for the info.
My personal instance has no custom emoji’s, yet the SQL to remove onload= from content removed 16 effected comments. Does that mean federated instances are effected?
This does not mean your instance was affected. You’re just cleaning up comments which may or may not have successfully worked on other instances by abusing the emoji bug there.
