Selfhosted

59864 readers

943 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam.
Posts here are to be centered around self-hosting. Please ensure it is clear in your post how it relates to self-hosting.
Don't duplicate the full text of your blog or git here. Just post the link for folks to click.
Submission headline should match the article title.
No trolling.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

Plausible critical RCE < 3.2.1 (github.com)

submitted 1 week ago by Calyhre@lemmy.world to c/selfhosted@lemmy.world

1 comments fedilink hide all child comments

Today I randomly felt on this release note, mentioning an RCE “under certain conditions “

Digging up a bit, it’s a full blown RCE on any default install. Worst, unless you were aware of the /storybook path, it’s very unlikely you blocked it.

I also wrote a small POC here https://gist.github.com/Calyhre/67337024ece3762cbc3c9e4956b0e3d4

If you are using Plausible 3.0.0 until 3.2.0 included, you should upgrade ASAP, and rotate everything

you are viewing a single comment's thread
view the rest of the comments

[–] kevincox@lemmy.ml 7 points 1 week ago

Oof, that is really not a good look. This should have been clearly disclosed and probably with a per-notification for the patch release.