-

2025-03-26 00:15:03

billstatler@forum.statler.ws

Looks like a serious #Pixelfed bug -- and a reminder that nothing is private in the Fediverse unless you encrypt it.

Pixelfed leaks private posts from other Fediverse instances - fiona fokus

When following someone on a different server on the Fediverse, the remote server decides whether you are allowed to do so. This enables features like private accounts. Due to an implementation mistake, Pixelfed ignores this and allows anyone to follow even private accounts on other servers. When a legitimate user from a Pixelfed instance follows yo...

show all 9 comments

2025-03-26 01:12:12

Der Pepe (Hubzilla) ⁂ ⚝

pepecyb@hub.hubzilla.hu

It seems (I've tried it) that #hubzilla is not affected by the bug.

2025-03-26 04:18:00

Tanja

tanja@hz.lazyteddy.eu

I don't know; this seems to be more of bug in the software of the sending server, in this case, Mastodon. I would expect the server where you have your private / locked account to put controls on who gets to see your private posts. I'm not saying Pixelfed couldn't handle this better, but a malicious actor could certainly exploit this.

2025-03-26 04:37:23

Bill Statler

billstatler@forum.statler.ws

I'll have to read it again more carefully. The flaw seems to be in posts that are restricted to "followers only", plus Pixelfed not confirming that a follow was accepted.

I can't remember whether this option exists in Hubzilla, but in (streams) we can select "Connections" as the audience for a post. This is the closest thing to Mastodon's "followers only", but I strongly suspect (streams) handles it in a different manner (e.g., as if the post is a bunch of Direct Messages to each connection).

2025-03-26 05:50:41

Mike Macgirvin 🖥️

mikedev@fediversity.site

As I read it, streams, forte, and hubzilla are all susceptible to this. Basically, it it arrived on a pixelfed server, the audience scope was ignored. I was concerned at first, but it appears that I may not actually have any connections on pixelfed. If you do, and your channel is followers-only, your posts may have leaked to non-followers.

2025-03-26 06:29:00

Bill Statler

billstatler@forum.statler.ws

Ugh. Do you think this would affect posts with a smaller audience, e.g. "Friends" or Direct Messages?

(I don't have any Pixelfed connections either, so it doesn't affect me directly.)

2025-03-26 06:54:33

Mike Macgirvin 🖥️

mikedev@fediversity.site

I can only guess at the the extent of the damage, but it's prudent to assume that anything of a "protected" nature that was delivered to pixelfed should be considered compromised unless/until proven otherwise. The spooky bit is that this goes back 6-7 years.

2025-03-26 12:12:13

Der Pepe (Hubzilla) ⁂ ⚝

pepecyb@hub.hubzilla.hu

I tried the following:

One of my channels is connected to my (old and rarely used... I don't really need it) Pixelfed channel (on a not yet patched Pixelfed server). It is a two-way connection, with the Hubzilla channel configured as ‘Public’ without any changes. Now I also have a test channel on the same hub, which is configured more restrictively (my posts are only visible to connections, connections are not automatically accepted). AP is activated for both channels.

And now I followed the test channel with my pixelfed channel in Hubzilla. I did not accept the connection request with the Hubzilla test channel.

I then posted a few messages on the test channel. These do not appear on the Pixelfed channel, although the test channel is listed there as ‘following’.

Have I misunderstood something? That would be exactly the scenario mentioned in the article and the posts from my restrictive Hubzilla test channel should appear there irregularly, shouldn't they?

2025-03-26 17:18:30

Der Pepe (Hubzilla) ⁂ ⚝

pepecyb@hub.hubzilla.hu

Bei YunoHost wurde wohl gerade ein Update ausgerollt: https://forum.yunohost.org/t/pixelfed-vulnerability-discovered-and-fixed-please-upgrade-to-0-12-5/36091

2025-03-26 18:08:04

Bill Statler

billstatler@forum.statler.ws

@Der Pepe (Hubzilla) ⁂ ⚝ - I think you tested the reverse of the scenario in the article. They are describing a situation with two Pixelfed channels and one non-Pixelfed channel.

Asterix@pixelfed has a two-way connection with Pepe@hubzilla. Obelix@pixelfed tries to follow Pepe@hubzilla, but Pepe rejects the follow.

Pepe@hubzilla sends a post to connections only. Pixelfed receives the post and correctly delivers it to Asterix@pixelfed, but also incorrectly delivers it to Obelix@pixelfed, because of this:

Pixelfeds ActivityPub implementation was (and still is) incomplete. They did export the as:manuallyApprovesFollowers property, but they didn’t import them for remote accounts. Hence remote accounts always displayed as Not Locked. While being annoying for users, this is not not a security issue in itself.

However, there was another issue. When pixelfed assumes that an account is not locked, it immediately treats a follow attempt as completed. For the server on the other end it looks like a normal follow request. It could be rejected, and pixelfed would still be convinced that a follow relation exists.