this post was submitted on 10 Jul 2023
107 points (100.0% liked)

Blahaj Lemmy Meta

2662 readers
21 users here now

Blåhaj Lemmy is a Lemmy instance attached to blahaj.zone. This is a group for questions or discussions relevant to either instance.

founded 2 years ago
MODERATORS
blahaj@lemmy.blahaj.zone
supakaity@lemmy.blahaj.zone
ada@lemmy.blahaj.zone
ada@piefed.blahaj.zone
107
Blåhaj Lemmy hacked (lemmy.blahaj.zone)
submitted 2 years ago by supakaity@lemmy.blahaj.zone to c/main@lemmy.blahaj.zone
23 comments fedilink hide all child comments
 

Hi everyone.

Lemmy had an XSS vulnerability and we were one of the instances attacked through this vulnerability. We had our homepage replaced by a youtube video.

The lemmy devs were quick to create a PR for this issue and we have patched our instance to fix it,

Also while I do not believe any login tokens were compromised, we have taken the additional measure of rotating our secret ket, so everyone will have to login to the site again as your existing credentials will no longer be valid.

Sorry that this happened, if you have any questions please contact @ada@lemmy.blahaj.zone or myself.

blobcat, heart

top 23 comments
sorted by: hot top controversial new old
[–] sapient_cogbag@sh.itjust.works 50 points 2 years ago

That's gotta be what, 4 hours from discovery to patch?

Impressive work from everyone nya :)

I love FOSS

[–] Krrygon@lemmy.blahaj.zone 11 points 2 years ago

Yeah thanks for being on top of things! That was a really quick fix by everybody. Glad to have this place back!

[–] tupewe@lemmy.blahaj.zone 8 points 2 years ago (1 children)

Damn that was quick! I didn't even notice LOL if it wasn't for this post I would have thought that my account got logged off just for a bug :p

Thank you and the lemmy devs for being so quick!! blobcat, heart

out of curiosity, what was the youtube video?

[–] tupewe@lemmy.blahaj.zone 1 points 2 years ago (2 children)

By the way, I don't know if this is related but I have an issue now after this

I can log in using the web app but in Jerboa when I log in I can see Im logged in but I when I try to do something like commenting it tells me I'm not, then after reopening the app I'm fully logged off again, has this happened to someone else?

[–] Still@programming.dev 2 points 2 years ago

you gotta sign out the master key used to authenticate your session was cycled, so you need to get a new one, jerboa gets confused cuz it already has one but is no longer valid

[–] BlessedDog@lemmy.ml 1 points 2 years ago

The master encryption key was rotated, meaning your current login creds/tokens are invalid and you have to login again.

[–] emi@lemmy.blahaj.zone 7 points 2 years ago

Thanks for everything 💜

[–] imekon@lemmy.blahaj.zone 3 points 2 years ago

had to remove cookies from lemmy.blahaj.zonw for my login to work

[–] CreamyWeenie@lemmy.blahaj.zone 2 points 2 years ago* (last edited 2 years ago)

I just had issues logging in, so I'm gonna make a comment in case anyone else is having issues.

TL;DR: Clear your cookies.

I couldn't log in from the main page, I would type everything correctly and it would give me a "logged in" popup in the corner, but I wouldn't actually be logged in. For some reason though I ended up being able to log in from my profile page though, but I wouldn't stay logged in unless I opened up my profile page and navigated from there. I was also able to log in from the main page while in a private window though, (incognito for chrome users) so I figured clearing my cookies would fix the issue. That's what I ended up doing, and I was able to log in from the main page and this time I stayed logged in. Sorry for the ramble, but I just wanted to put down everything that happened since it's clearly a bug with the site, and if someone were to fix this they're gonna want as much details as can be provided.

[–] hollyberries@lemmy.blahaj.zone 2 points 2 years ago

Thanks for handling this super quickly! Y'all are the best! blobcat, huggies

[–] Noedel@lemmy.ml 2 points 2 years ago

Test

[–] hyperborean@lemmy.blahaj.zone 1 points 2 years ago (1 children)

I haven't logged on to instances for a week and everything is already on fire.

Looks like I missed all the fun.

[–] alexiascylding@lemmy.blahaj.zone 0 points 2 years ago (1 children)

glad things are back to normal, hope yall harden security. Thanks for your work

[–] supakaity@lemmy.blahaj.zone 1 points 2 years ago* (last edited 2 years ago)

Well, I don't technically work on the lemmy codebase (I have my hands full with adminning 3 instances and working on Hajkey), but yes I agree it'd be nice if the lemmy dev team could spend some time reviewing and improving the security, in amongst all the other stuff they have to do since Reddit imploded.

[–] Sunny@lemmy.blahaj.zone 0 points 2 years ago (1 children)

Many thanks for sharing and quick measures taken 👍 I tried to change my password now, but it doesn’t safe the new one in my personal settings. Is there anything to consider additionally?

[–] supakaity@lemmy.blahaj.zone 2 points 2 years ago (1 children)

Not sure.

Some people have had to clear cookies to get things working again properly.

Are you getting an error message in the javascript console?

[–] Sunny@lemmy.blahaj.zone 1 points 2 years ago (1 children)

Hi Kaity, thank you for answering so quickly and sorry took a while for me. I am using my iPad and it’s Safari. I noticed that everything seems to be a bit delayed, slow. I have again tried to set a new password and I tried to log out afterwards but the log-out somehow doesn’t work. I suppose there is a time limit to stay logged ans I will wait for that to try again the old and new password (today my Safari safed one worked thankfully)

[–] supakaity@lemmy.blahaj.zone 1 points 2 years ago (1 children)

It seems like it is an identified issue with token invalidation in lemmy and they will be fixing (or have already fixed?) it in a future upgrade.

I'll keep an eye out for it and try to get it in as soon as possible. In the meantime, clearing site cookies while tricky is the only real option.

[–] Sunny@lemmy.blahaj.zone 1 points 2 years ago

Thank you very much 👍🏻