GHSA-wr2m-38xh-rpc9: 
Rust vulnerability analysis and mitigation

An improper uploaded media ownership check vulnerability was discovered in Lemmy server versions >=0.17.0 and <0.19.11, identified as GHSA-wr2m-38xh-rpc9. The vulnerability could result in inadvertent deletion of media when a user is banned with content removal or purged, potentially leading to deletion of media not uploaded by the banned/purged user. This issue also affects purged communities, where all media posted in that community could be deleted without proper ownership verification (GitHub Advisory).

The vulnerability stems from Lemmy's lack of user-media upload association prior to version 0.19.0. The media storage backend, pict-rs, implements two types of deletion: regular deletion which removes only referenced aliases, and purge which deletes all aliases and the backing file. The vulnerability arose from the logic implemented in 0.17.0 that iterates over media URLs related to users and communities during purging operations, resulting in full deletion of backing media even if the same URL was uploaded by different users or the same media was uploaded with different aliases. The issue is limited to media with an image/* content-type returned by pict-rs (GitHub Advisory).

The impact varies based on instance configuration. For instances with open federation (the majority), the vulnerability can be exploited remotely without authentication. For instances with limited or no federation, exploitation requires user interaction by an admin of the targeted instance or a federation-linked instance if federation is enabled. The vulnerability has been assigned a CVSS score of 6.9 (Moderate) with attack vector: Network, attack complexity: Low, and privileges required: None (GitHub Advisory).

The vulnerability has been patched in version 0.19.11. The fix includes changes to ensure proper media ownership verification and limiting the scope of media deletion operations. Administrators should upgrade to version 0.19.11 or later to mitigate this vulnerability (GitHub Advisory).