Critical Security Vulnerability: XSS in Post URL

[henfredemars]

Requirements

• This is a bug report, and if not, please post to https://lemmy.ml/c/lemmy_support instead.
• Please check to see if this issue already exists.
• It's a single bug. Do not report multiple bugs in one issue.
• It's a frontend issue, not a backend issue; Otherwise please create an issue on the backend repo instead.

Summary

Copied from post at https://sh.itjust.works/post/774797
I hope this will be useful here.

---

What is XSS?

Cross-site scripting (XSS) is an exploit where the attacker attaches code onto a legitimate website that will execute when the victim loads the website. That malicious code can be inserted in several ways. Most popularly, it is either added to the end of a url or posted directly onto a page that displays user-generated content. In more technical terms, cross-site scripting is a client-side code injection attack. https://www.cloudflare.com/learning/security/threats/cross-site-scripting/

Impact

One-click Lemmy account compromise by social engineering users to click your posts URL.

Reproduction

Lemmy does not properly sanitize URI’s on posts leading to cross-site scripting. You can see this working in action by clicking the “link” attached to this post on the web client.

To recreate, simply create a new post with the URL field set to: javascript:alert(1)//

Patching

Adding filtering to block javascript: and data: URI’s seems like the easiest approach.

Steps to Reproduce

1. Create a new post with the URL field set to: javascript:alert(1).
2. Click on the post. JS is executed.

Technical Details

N/A

Lemmy Instance Version

0.18.0?

Lemmy Instance URL

https://sh.itjust.works/post/774797

[henfredemars]

It looks like this was just reported on the backend project where it likely belongs. Please excuse.

[necropola]

@henfredemars @SleeplessOne1917 I think this is still something which needs to be addressed in the UI, too.

The current PR LemmyNet/lemmy#3508 for issue LemmyNet/lemmy#3505 does not handle javascript in Post URLs which are already stored in the DB. Wouldn't it make sense to

• sanitize data from the Backend/api before creating html output from it
• and validate user data before writing it to the Backend/api?

[necropola]

https://www.w3.org/TR/activitypub/#security-sanitizing-content