[bug] Javascript insertion via media Vulnerability

Twizzay commented

2023-05-26 05:04:23 +00:00

This vulnerability was discovered today.

I have double-checked and have not found this issue mentioned anywhere.

This vulnerability was discovered today. ![05-25-2023_09:59%:29PM](https://github.com/YunoHost-Apps/akkoma_ynh/assets/88040412/98977adf-1605-491c-aeea-1dddfc5ea05b) - [x] I have double-checked and have not found this issue mentioned anywhere.

Twizzay added the

bug

label 2023-05-26 05:04:23 +00:00

Twizzay commented

2023-05-26 05:05:13 +00:00

Author

Sorry this may not be the right place to put this.

This is my first created issue around here.

Sorry this may not be the right place to put this. This is my first created issue around here.

Twizzay changed title from ~~[bug]~~ to [bug] Javascript Vulnerability

2023-05-26 05:05:44 +00:00

floatingghost commented

2023-05-26 11:35:31 +00:00

Owner

fix applied and released

floatingghost closed this issue

2023-05-26 11:35:31 +00:00

Seirdy commented

2023-05-26 18:13:34 +00:00

Contributor

My understanding is that the sandbox directive should have been fine, since it forbids JS execution. It's actually a bit stronger than script-src, as it forbids scripts from running even if they bypass CSP fetch directives (e.g. scripts injected by the user-agent).

The most bulletproof CSP for media would be this:

default-src 'none'; upgrade-insecure-requests; sandbox

(if you wanna go overkill, use base-uri 'none'; form-action 'none'. Shouldn't be necessary for static media and SVGs with the secure static processing mode enforced by the img element).

This would prevent anything from loading except the single media resource.

Other instances that load something more advanced (e.g. ruffle.rs flash animations) or support hotlinking could also request browsers to use strict origin isolation:

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
origin-agent-cluster: ?1

I don't know Elixir but this doesn't seem too hard; I could draft a PR if you're interested.

My understanding is that the `sandbox` directive should have been fine, since it forbids JS execution. It's actually a bit stronger than `script-src`, as it forbids scripts from running even if they bypass CSP fetch directives (e.g. scripts injected by the user-agent). The most bulletproof CSP for media would be this: ``` default-src 'none'; upgrade-insecure-requests; sandbox ``` (if you wanna go overkill, use `base-uri 'none'; form-action 'none'`. Shouldn't be necessary for static media and SVGs with the secure static processing mode enforced by the `img` element). This would prevent anything from loading except the single media resource. Other instances that load something more advanced (e.g. ruffle.rs flash animations) or support hotlinking could also request browsers to use strict origin isolation: ``` cross-origin-resource-policy: cross-origin cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin origin-agent-cluster: ?1 ``` I don't know Elixir but this doesn't seem too hard; I could draft a PR if you're interested.

Twizzay commented

2023-05-26 19:03:56 +00:00

Author

Some new information...

Might need to reopen.

Some new information... Might need to reopen.

05-26-2023_12:02%:57PM.png

100 KiB

floatingghost commented

2023-05-26 19:34:23 +00:00

Owner

luckily we don't rely on a one-line nginx modification

we tightened csp way back in 336d06b2a8, which pleroma (and soapbox by extension) never got around to doing afaik

luckily we don't rely on a one-line nginx modification we tightened csp way back in https://akkoma.dev/AkkomaGang/akkoma/commit/336d06b2a8ca75362578b1d67ea1f32a45c8edd3, which pleroma (and soapbox by extension) never got around to doing afaik

floatingghost commented

2023-05-26 19:38:06 +00:00

Owner

(also, for the love of christ do not link gleasonator here, this entire place pretty much exists to get away from that idiot)

Twizzay changed title from ~~[bug] Javascript Vulnerability~~ to [bug] Javascript insertion via media Vulnerability

2023-05-26 20:13:17 +00:00

Twizzay commented

2023-05-26 20:15:53 +00:00

Author

luckily we don't rely on a one-line nginx modification

we tightened csp way back in 336d06b2a8, which pleroma (and soapbox by extension) never got around to doing afaik

hek ya, sun. I am going to trust that this vulnerability does not affect Akkoma users anymore, then.

(also, for the love of christ do not link gleasonator here, this entire place pretty much exists to get away from that idiot)

My mistake. I edited my reply.

> luckily we don't rely on a one-line nginx modification > > we tightened csp way back in https://akkoma.dev/AkkomaGang/akkoma/commit/336d06b2a8ca75362578b1d67ea1f32a45c8edd3, which pleroma (and soapbox by extension) never got around to doing afaik > > hek ya, sun. I am going to trust that this vulnerability does not affect Akkoma users anymore, then. > (also, for the love of christ do not link gleasonator here, this entire place pretty much exists to get away from that idiot) My mistake. I edited my reply.

floatingghost commented

2023-05-26 20:16:41 +00:00

Owner

the HTML sanitisation issue from pleroma has been pulled in though - that is in release v3.9.3 (just out)

i think that's everything

the HTML sanitisation issue from pleroma has been pulled in though - that is in release v3.9.3 (just out) i _think_ that's everything

👍 1

~~Oneric referenced this issue 2024-05-07 00:22:42 +00:00~~

Preserve Meilisearch’s result ranking #772

[bug] Javascript insertion via media Vulnerability #547