Instance Owners: Do Not Use Lemmy-Thumbnail-Cleaner
If you are using https://github.com/wereii/lemmy-thumbnail-cleaner please stop and disable it as soon as possible.
We have found a security issue that allows any user to make LTC delete any locally hosted image.
I will be posting more details soon and editing this to include the information.
E: More information here https://github.com/wereii/lemmy-thumbnail-cleaner/issues/10
6 replies
Ah. So Lemmy with version 0.19.4+ allows users to set a custom thumbnail URL for a post, which can be set to pretty much anything resembling a valid link, especially a link to another image in the local pictrs db and trigger a deletion of both when a minimum age check is passed.
Also this:
On point summary.
And I was just about to write that I have confirmed SQLi is not possible to find out I have missed something that might in-turn make it possible! holy hell back to drawing board
Yikes. Thanks for putting in the works and sharing your findings to you and @[email protected].
I'm really curious how someone can exploit a script that is meant to be running locally with no external facing interface
Post edited with link to more information.
thanks