pomstan, 9 months ago

@lanodan how this can be exploited?

lanodan, 9 months ago (edited 9 months ago)

@pomstan /api/v1/pleroma/remote_interaction (public) is a known way.

And I'm not a full-disclosure-on-day0 person so if you want exploit details it'll have to wait until I can be reasonably sure people have their software fixed.

feld, 9 months ago

At least we are now in the same company as Postgres who also had this vulnerability in 2012 🥲

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3489

lanodan, 9 months ago

@feld >libxml2

Uuuh… let's say I'm glad I don't have untrusted/remote XML in my other software.

feld, 9 months ago

Hello friends, I invite you to check this blog post that I found after receiving the report:

https://vuln.be/post/xxe-in-erlang-and-elixir/

Apparently the bundled Erlang XML library xmerl along with a few other Erlang/Elixir XML parsers are vulnerable by default and we had no clue.

shpuld, 9 months ago

@lanodan thanks for quick fixes

lanodan, 9 months ago

Also it was reported by @Mae so thanks a lot!

feld, 9 months ago

Thank you for finding this Mae

every little fix makes us closer to being impenetrable 😇