Fediverse

26080 readers

22 users here now

A community dedicated to fediverse news and discussion.

founded 6 years ago

MODERATORS

deadsuperhero@lemmy.ml

wakest@lemmy.ml

392

PSA: Lemmy.world has been compromised! (lemmy.ml)

submitted 3 years ago* (last edited 3 years ago) by G59@lemmy.ml to c/fediverse@lemmy.ml

133 comments fedilink hide all child comments

FYI!!! In case you start getting re-directed to porn sites.

Maybe the admin got hacked?

edit: lemmy.blahaj.zone has also been hacked. beehaw.org is also down, possibly intentionally by their admins until the issue is fixed.

Post discussing the point of vulnerability: https://lemmy.ml/post/1896249

you are viewing a single comment's thread
view the rest of the comments

[–] thanks_shakey_snake@lemmy.ca 2 points 3 years ago

Yeah the "redirect somewhere else" attack definitely doesn't necessarily require any particular control of the site. Usually it's noticing that you can trick some text into being run as Javascript, instead of interpreted as text... And then you just stick in a cheeky little <notarealscript>window.location = "https://www.badsite.horse"</notarealscript> into that spot.

Then every time that comment, username, (in this case apparently) custom emoji, etc. gets loaded, whoops, the code runs and off you go!

So no control of the site is required at all.