The spam campaign attacking Writefreely instances is out of control. Can you contact the admins you know?

Yesterday I received this message from my friend @elettrona:

Are you the one running the "writefreely blogs" bot, aka writefreely@poliverso.org? Because there are tons of English accounts full of links that post nonstop.

And indeed, that account republishing posts from some Italian instances had a staggering amount of spam.

This is due to a very serious vulnerability that hasn't yet been patched by the developers, but which has (obviously) started to be exploited on a large scale.

I've notified all the Italian administrators of @writefreely instances, but I'm having some difficulty contacting the foreign ones.

These are the ones with the most users:

https://write.otter.homes/read
https://infosec.press/read
https://blog.liberta.vip/read
https://write.tedomum.net/read
https://val-vgms.gay/read
https://bolha.blog/read

But there are many others.

Is there anyone among you who can try this or at least spread the word?

Note: As I mentioned, the vulnerability has been known for a long time and is currently being exploited on a large scale.

https://github.com/writefreely/writefreely/issues/1649

Bolhaverso

Bolhaverso Reader

Read the latest posts from Bolhaverso.

Val 🏳️‍⚧️

Val 🏳️‍⚧️ Reader

Lee las últimas publicaciones de Val 🏳️‍⚧️.

TeDomum Write

TeDomum Write Reader

Read the latest posts from TeDomum Write.

Liberta Blogs

Liberta Blogs Reader

Read the latest posts from Liberta Blogs.

Infosec Press

Infosec Press Reader

Read the latest posts from Infosec Press.

Otter Log

Otter Log Reader

Read the latest posts from Otter Log.

GitHub

Registration possible via /auth/signup when open_registration=false · Issue #1649 · writefreely/writefreely

Currently it's possible to register a new user on a multiuser writefreely server by sending a POST request to /auth/signup and despite setting open_registration=false in the configuration a fully u...

12 months ago

Group:

Unknown type of activity/object

6 Replies

0 Boosts

marud

@marud@piefed.marud.fr 2 hours ago

Holy shit this is so bad. I’m gonna shut my own instance down RN and see for something else

macfranc

@macfranc@poliversity.it 1 hour ago

@marud

PS: Fabio, who reported this technical solution to address the issue, is not only a former contributor to Wrirefreely but also the developer of this new platform.

If yours is a personal instance, you could replace WF with this new Madblog:

https://github.com/blacklight/madblog

GitHub

GitHub - blacklight/madblog: A minimal platform for Markdown-based blogs

A minimal platform for Markdown-based blogs. Contribute to blacklight/madblog development by creating an account on GitHub.

macfranc

@macfranc@poliversity.it 1 hour ago

@marud
⬇️⬇️⬇️⬇️⬇️
https://manganiello.eu/notice/B8QIIxBV9VQQaBr7iq

Fabio Manganiello

@fabio@manganiello.eu 2 hours ago

@macfranc @elettrona @writefreely the issue has been addressed here: https://github.com/writefreely/writefreely/pull/1686

Still, the behaviour from the WriteFreely development team has been quite appalling - issue reported in May, addressed by a maintainer just 2 weeks ago, and going through a standard release process (which may take a couple of months) instead of being pushed as an urgent hotfix.

For now:

Workaround: pull the latest version of WriteFreely (git clone https://github.com/writefreely/writefreely) and build it (via make), then replace your WF executable with the newly built one.
Long-run (+ self-promotion): migrate to Madblog, but that’s not always a 1-1 option at the curent state because it still lack multiuser support.

GitHub

Prevent signups via /auth/signup with closed registrations by thebaer · Pull Request #1686 · writefreely/writefreely

Previously, there was no check in place on the web-based /auth/signup endpoint to ensure users can't still be created while registrations are closed. Fixes #1649 I have signed the CLA

Platypush Git

madblog

A minimal, general-purpose Markdown-based CMS.

macfranc

@macfranc@poliversity.it 2 hours ago

@fabio Oh, great idea! This could be an excellent temporary solution to the problem. Thanks for reporting it!

@elettrona @writefreely

Jupiter Rowland

@JupiterRowland@sh.itjust.works 3 hours ago

“Use WriteFreely instead of Plume,” they said.

“It’s in active development,” they said.

Then again, if this was to happen to Plume (and I wouldn’t be surprised if it was), it’d take the devs until the 2030s to fix it.

Discussion

Post

Is there anyone among you who can try this or at least spread the word?

Note: As I mentioned, the vulnerability has been known for a long time and is currently being exploited on a large scale.