Conversation

Notices

1. Alex Gleason (alex@gleasonator.com)'s status on Saturday, 27-May-2023 02:54:58 JST Alex Gleason

   Pleroma / Akkoma / Rebased need to be patched, but here’s how you can secure your site without any code changes:

   yoursite.com/media -> media.yoursite.com
   yoursite.com/proxy -> proxy.yoursite.com

   To do this, add the following configuration to your site:

   config :pleroma, Pleroma.Upload, base_url: "https://media.yoursite.com" config :pleroma, :media_proxy, base_url: "https://proxy.yoursite.com"

   You will need to add DNS records for the subdomains. For media, it’s recommended to use an S3 bucket (or equivalent). For the proxy, you can simply point the DNS to the same server, and edit your Nginx file. A sample Nginx file is here: https://termbin.com/tj7q You’re on your own setting up letsencrypt, etc.

   Here’s what does NOT work:

   • A CSP one-liner in Nginx. That’s not how CSP works. CSP affects the page it was loaded on, not other resources. This is straight up misinformation.

   • Disabling the media proxy on its own. The media proxy does appear to be vulnerable, but it cannot be the only action you take.

   • GNU social JP管理人 and xianc78 like this.
   • Moon (moon@shitposter.club)'s status on Saturday, 27-May-2023 03:13:31 JST Moon

     in reply to
     @alex I am getting "forbidden" for every file now :-/
   • Disinformation Purveyor :verified_think: (thatguyoverthere@shitposter.club)'s status on Saturday, 27-May-2023 03:13:31 JST Disinformation Purveyor :verified_think:

     in reply to

     • Moon
     @Moon @alex sounds secure to me
   •  (mint@ryona.agency)'s status on Saturday, 27-May-2023 03:14:33 JST 

     in reply to

     • Moon
     @Moon @alex Don't you already serve all the files from static.banky.club?
   • Moon (moon@shitposter.club)'s status on Saturday, 27-May-2023 03:16:34 JST Moon

     in reply to

     • 
     @mint @alex uploads are served from banky.club but mediaproxy is the proxy for remote images from other servers
      likes this.
   • LS (lain@lain.com)'s status on Saturday, 27-May-2023 03:29:25 JST LS

     in reply to

     • NEETzsche
     @NEETzsche @alex the advice was still correct, i just found a separate exploit that wasn't used, apparently. The one I found is fixed by the CSP setting, the more general one that we found in our oembed parser/pleroma-fe is being fixed by a new release we're preparing, but moving the media and proxy to their own domains like alex recommended will also fix both issues.
      likes this.
   • Alex Gleason (alex@gleasonator.com)'s status on Saturday, 27-May-2023 03:29:26 JST Alex Gleason

     in reply to

     • NEETzsche
     • LS
     @NEETzsche No I want @lain to do it.
   • NEETzsche (neetzsche@iddqd.social)'s status on Saturday, 27-May-2023 03:29:26 JST NEETzsche

     in reply to

     • LS
     @alex @lain fucking why, as punishment for giving incorrect nginx advice?
   • NEETzsche (neetzsche@iddqd.social)'s status on Saturday, 27-May-2023 03:29:27 JST NEETzsche

     in reply to
     @alex stop arguing with retards online and write the patch