PLEROMA ADMINS READ THIS, AKKOMA TOO
Another important pleroma security post: Alex Gleason (npub108p…yev6) and anime graf mays 🛰️🪐 (npub108z…dkr5) found ANOTHER injection bug, and this one was probably used for the attack. I think that single user instances are probably not affected, but I wouldn't want to risk it. Move your media and proxy to a subdomain as alex initially recommended, it's not complicated and takes 15 minutes, and eliminates this whole class of bugs.
Fix is being worked on, but just do the media/proxy thing now so you'll never have to worry about this again.
https://webb.spiderden.org/2023/05/26/pleroma-mitigation/
lainy /
npub1wa…9xc8t
2023-05-29 09:28:03
Author Public Key
npub1wahdrf28uf5n5tykfeyzf43sdgg65djvm8re3ulpentr3teaxujs09xc8tPublished at
2023-05-29 09:28:03Event JSON
{
"id": "6182ca432e79ea7a2c7a9331b23bfb2e30b7b0e53afc27aa907f922390d9619c",
"pubkey": "776ed1a547e2693a2c964e4824d6306a11aa364cd9c798f3e1ccd638af3d3725",
"created_at": 1685352483,
"kind": 1,
"tags": [
[
"p",
"79c2cae114ea28a981e7559b4fe7854a473521a8d22a66bbab9fa248eb820ff6",
"wss://relay.mostr.pub"
],
[
"p",
"79c4b3e2b1e7d8d74fa652cdc1dee37f9cd08fefdc13a79f8d1146c0b69fd1fb",
"wss://relay.mostr.pub"
],
[
"mostr",
"https://lain.com/objects/955177ed-e085-4522-a708-4ca526558a92"
]
],
"content": "PLEROMA ADMINS READ THIS, AKKOMA TOO\n\nAnother important pleroma security post: nostr:npub108pv4cg5ag52nq082kd5leu9ffrn2gdg6g4xdwatn73y36uzplmq9uyev6 and nostr:npub108zt8c43ulvdwnax2txurhhr07wdprl0msf608udz9rvpd5l68ascvdkr5 found ANOTHER injection bug, and this one was probably used for the attack. I think that single user instances are probably not affected, but I wouldn't want to risk it. Move your media and proxy to a subdomain as alex initially recommended, it's not complicated and takes 15 minutes, and eliminates this whole class of bugs.\n\nFix is being worked on, but just do the media/proxy thing now so you'll never have to worry about this again.\n\nhttps://webb.spiderden.org/2023/05/26/pleroma-mitigation/",
"sig": "0d9495a70abdf272034290916dea68258c800acc7b234b35e00bb6d352e006f7c1238995ee359828bc9c55c3f6e645eca31e90d035968955ba3f4642eb45e777"
}