this post was submitted on 10 Jul 2023
6 points (100.0% liked)

General

2 readers
1 users here now

Feel like you have something to post, but it's not really relevant to any of the current communities, and you don't feel like it's worth making an entirely new community just to post it? This is the place for that.

NSFW content is allowed in this community so long as you mark it as per site rules.

founded 1 year ago
MODERATORS
Disabled@burggit.moe
6
Beware of clicking on links in all Lemmy instances (burggit.moe)
submitted 1 year ago* (last edited 1 year ago) by SmolSlime@burggit.moe to c/general@burggit.moe
7 comments fedilink hide all child comments
 

There's a JavaScript injection exploit going on. Apparently the exploit also works on comments, just by embedding an image and adding some JS code in it. I don't know if this could steal the entire cookies or just the website's, but just to be safe don't randomly click every link.

The post below is copy pasted from https://kbin.social/m/android@lemdro.id/t/168524/Lemmy-world-and-another-instance-have-been-compromised#entry-comment-661712

Some information I have posted to Lemmy.World:

I am not a super code-literate person so bare with me on this… But. Still please becareful. There appears to be a vulnerability.

Users are posting images like the following:

imgur.com/a/RS4iAeI

And inside hidden is JavaScript code that when executed can take cookie information and send it to a URL address.

Among other things. At this time if you see an image please click the icon circled before clicking the link. DO NOT CLICK THE IMAGE. If you see anything suspicious, please report it immediately. It is better a false report than a missed one.

I have seen multiple posts by these people during the attack. It is most certainly related to JS.

you are viewing a single comment's thread
view the rest of the comments
[–] Disabled@burggit.moe 4 points 1 year ago (1 children)

We're currently working on implementing a patch someone deployed to burggit. Stay tuned!~

[–] SmolSlime@burggit.moe 3 points 1 year ago

That's great news! I just made this post as an additional warning to other users who browse other instances, since the previous post only mentioned sidebar exploit.