FYI!!! In case you start getting re-directed to porn sites.

Maybe the admin got hacked?

edit: lemmy.blahaj.zone has also been hacked. beehaw.org is also down, possibly intentionally by their admins until the issue is fixed.

Post discussing the point of vulnerability: https://lemmy.ml/post/1896249

  • StudioLE@programming.devEnglish
    2·
    1 year ago

    I’m not particularly familiar with XSS but I’m curious how a frontend exploit can compromise an instance?

    Presumably the injected XSS stores the admin’s JWT somewhere for the exploiter?

    Then using that JWT they can effectively login as the admin which gives them access to whatever admin dashboard there is, but does that actually compromise the backend at all?

    edit: for anyone curious there’s a bit of a breakdown of how it works here: https://feddit.win/comment/244427