121
Umami is vulnerable - upgrade immediately (jlai.lu)
submitted 11 months ago by to c/selfhosted@lemmy.world
13 comments fedilink hide all child comments
 

All umami instances have been infected with a persisting crypto miner. Umami was affected by the next.js CVE but quietly released a fix, so most of their users missed it

you are viewing a single comment's thread
view the rest of the comments
[–] 34 points 11 months ago (4 children)

Link? Did you discover this yourself? There is no actual info here.

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] [S] 12 points 11 months ago (1 child)

    All recently open issues are about this. I was a victim, but I'm not the first and people on reddit have done better investigations than I have. Look for the name of the process at the top

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 32 points 11 months ago*

    Thanks.

    For severe incidents like this, please post the most appropriate link, in this case https://github.com/umami-software/umami/issues/3852

    Admins in self hosted usually don't have that much experience with real, active compromise and may panic, let's help them as much as possible.

    I will add that Umami itself is not compromised, but vulnerable. That is a somewhat misleading title.

    What was the vector? Did you have umami exposed publicly?

  • permalink
  • fedilink
  • source
  • parent