1. Inject exploit into a comment using custom emoji.
2. Front-end parses the emoji incorrectly allowing JavaScript to be injected.
3. JavaScript loads for everyone to views a page with the comment and sends their token and account type to the hackers domain.
4. Hacker parses received tokens for admins and uses that to inject redirects into the front page of the Lemmy instance.

To answer your other questions:

• IMO there probably should be better parsing to remove this stuff from the back-end, so I’m not sure the front-end solution is the complete solution, but it should get things largely under control.
• Back-end is theoretically not compromised besides needing to purge all the rogue comments. Attacker presumably never had access to the server itself.
• Probably needs to be a mass reset of ALL passwords since lots of people’s tokens were sent during the attack, so their accounts could be compromised.

I don’t think so, but I’d love to be proven wrong!

Oh man this one is SO much worse. If this is what is going on the only way to kick out the hacker will probably be to manually alter the DB. Yikes.

I hope the admin team is aware of this - not sure how one would even contact them.

The issue does say changing the password should kick the user out, but yeah, still not good.

Oh man, that would be brutal if they are resetting the password and it isn’t kicking the attacker out…

Yeah, I’ve been scared to turn on 2FA with all the reports of people being locked out:

• https://github.com/LemmyNet/lemmy/issues/3309
• https://github.com/LemmyNet/lemmy/issues/3325
• https://github.com/LemmyNet/lemmy-ui/issues/1559

There’s actually another thread on exactly this topic: https://lemmy.ml/post/1875767

I actually consider it good news that the redirection is happening this way (something that can be done just by having the lemmy credentials of an admin) vs something indicating they have access to the server itself.

My concern is that configuring the site to automatically redirect users sounds like they have pretty large control over the site - the kind of control that I would assume is usually limited to users with root access on the server.

Obviously hope nothing of value is lost and that there is a proper off-site backup of the content.

Edit: See Max-P’s comment, it looks like the site redirection was accomplished in a way that IMO suggests they do NOT have full control over the site. We’ll obviously have to wait for the full debrief from the admins.

4AM in the Netherlands where the instance owner Ruud lives… hopefully his assistant admins can clean it up, but it might be a bit before he even knows anything is wrong.