# UPDATE: The latest RC version of Lemmy-ui (0.18.2-rc.2) contains fixes for the
issue, but if you believe you were vulnerable, you should still rotate your JWT
secret after upgrading! Read below for instructions. Removing custom emoji is no
longer necessary after upgrading. Original post follows: ---- This post is
intended as a central place that admins can reference regarding the XSS incident
from this morning. ### What happened? A couple of the bigger Lemmy instances had
several user accounts compromised through stolen authentication cookies. Some of
these cookies belonged to admins, these admin cookies were used to deface
instances. Only users that opened pages with malicious content during the
incident were vulnerable. The malicious content was possible due to a bug with
rendering custom emojis. Stolen cookies gave attackers access to all private
messages and e-mail addresses of affected users. ### Am I vulnerable? If your
instance has ANY custom emojis, you are vulnerable. Note that it appears only
local custom emojis are affected, so federated content with custom emojis from
other instances should be safe. ### I had custom emojis on my instance, what
should I do? This should be enough to mitigate now: 1. Remove custom emoji
DELETE FROM custom_emoji_keyword; DELETE FROM custom_emoji; 2. Rotate your JWT
secret (invalidates all current login sessions) -- back up your secret first,
just in case SELECT * FROM secret; -- generate a new secret UPDATE secret SET
jwt_secret = gen_random_uuid(); 3. Restart Lemmy server If you need help with
any of this, you can reach out to me on Matrix (@sunaurus:matrix.org) or on
Discord (@sunaurus) ### Legal If your instance was affected, you may have some
legal obligations. Please check this comment for more info:
https://lemmy.world/comment/1064402 [https://lemmy.world/comment/1064402] #####
More context: https://github.com/LemmyNet/lemmy-ui/issues/1895
[https://github.com/LemmyNet/lemmy-ui/issues/1895]
https://github.com/LemmyNet/lemmy-ui/pull/1897
[https://github.com/LemmyNet/lemmy-ui/pull/1897]
You can read the breakdown of the XSS incident at Lemmy.world.
This won’t be an issue for Wayfarers’ Haven because we don’t actually have any custom emoji.
My main account was indeed also the admin account for the server. If I had seen that script, that would have made this server vulnerable to the attack - I may have and we just missed it out of sheer luck. That and the backup account have both been moved to alternate accounts - I’m now following security best practices by separating out admin and every day use users.
The only practical change here is that I now have to log in as a separate user to approve applications and if I feel like changing the sidebar. I’ll live. :)
