Crumb
c/main · by seahorse@midwest.social · 3y

Regarding the recent Lemmy hack \*Update\*

In case you're not aware, multiple Lemmy instances suffered hacks recently that allowed the hackers to gain admin privileges and deface the instances and/or redirect users to other sites. Luckily, midwest.social was not a victim of this from what I can tell. To mitigate any more issues I have deleted the single custom emoji that had been uploaded and rotated the JWT which means you will have to log in again on all your devices.

Update: The devs have released 0.18.2 with a security fix for this and I've upgraded to it.

108 points · 16 comments · view on lemmy.world

16 Comments

linuxdaemon@midwest.social · 9 pts · 3y (1 reply)

If you log in and it doesn't show your username, you might have to clear your cookies for midwest.social and login again. I had to do that in Firefox anyway.

EssentialCoffee@midwest.social · 4 pts · 3y

Thanks for this. I needed to do this on Jerboa too.

chicory@midwest.social · 9 pts · 3y

Thank you!

BlueLineBae@midwest.social · 5 pts · 3y

Thank you for your work and keeping us safe!

Ascrod@midwest.social · 5 pts · 3y

Thank you!

rubbs@midwest.social · 5 pts · 3y

Thank you!

trafguy@midwest.social · 4 pts · 3y

Thanks, I did a search and found more discussion:

So basically, it sounds like the issue is insufficient input sanitation in the markdown editor allowing unexpected JS to execute on the site. Sounds like the front end can be compromised, but I don't see anyone saying the back end is compromised, although an admin on lemmy.world was compromised.

TheCraiggers@midwest.social · 3 pts · 3y

Thanks for your hard work!

george@midwest.social · 3 pts · 3y

Thanks for providing this space for us!

survivorseason44@midwest.social · 3 pts · 3y

Thank you for the update! 👍

SaintWacko@midwest.social · 2 pts · 3y (2 replies)

Not sure if it's related, but my midwest.social account had disappeared from wefwef and I had to log back in

seahorse@midwest.social · 4 pts · 3y (1 reply)

Yeah, that's because of the new token.

SaintWacko@midwest.social · 3 pts · 3y

Oh. Wow, was that bit about the JWT always there? Did I just completely gloss over it?

FormerGameDev@midwest.social · 1 pts · 3y

so... interestingly, account settings seem to be somehow related to that, as all my settings got mangled.

also, holy cow the dark theme on this is terrible