Lemmy v0.19.19 Vulnerability Advisory: Stored XSS, User Enum, XFF Spoofing

Vulnerability Overview Lemmy v0.19.19 contains multiple security vulnerabilities, primarily involving the following aspects: 1. X-Forwarded-For Header Spoofing: Lemmy's default Nginx configuration uses to set the header, which does not override existing values. Clients can forge IP addresses and bypass rate limits. 2. User Enumeration via Login Endpoint: User enumeration is possible through HTTP response codes and timing analysis. 3. Blocked Users Can Edit Private Messages: Messages sent before being blocked can still be edited. 4. Lower-Level Fediverse Administrators Can Remove Higher-Level Administrators: This occurs via federated operations. 5. Community Rules Not Verified When Posting: Community rules are not validated when publishing posts via federation. 6. Stored XSS: Achieved in the Lemmy UI through Markdown image alt text. Impact Scope X-Forwarded-For Header Spoofing: Affects instance administrators using the default Nginx configuration. User Enumeration via Login Endpoint: Affects all users, potentially leading to information leakage. Blocked Users Can Edit Private Messages: Affects blocked users and message recipients. Lower-Level Fediverse Administrators Can Remove Higher-Level Administrators: Affects all federated administrators. Community Rules Not Verified When Posting: Affects all communities and post publishers. Stored XSS: Affects all users utilizing the Lemmy UI. Remediation 1. X-Forwarded-For Header Spoofing: - Replace with . - If using Ansible, this will be updated automatically during upgrades; otherwise, manually modify the Nginx configuration to ensure any header sent by the client is overwritten. 2. Other Vulnerabilities: - Upgrade to the latest version to fix all other security vulnerabilities. Upgrade Notes There are no breaking changes. Follow the upgrade instructions applicable to or . For assistance, please ask questions in the support forum or on Matrix Chat. Support Development Thanks to all contributors and users. Ways to support Lemmy development include: - Liberapay (recommended option) - Open Collective - Patreon - Cryptocurrency Code Blocks No POC code or exploit code is provided.

Goal Reached Thanks to every supporter — we hit 100%!

Lemmy v0.19.19 Vulnerability Advisory: Stored XSS, User Enum, XFF Spoofing