Danbooru Flash XSS worm stole viewer IPs and hijacked accounts
Original title: About the downtime and security incident
The site was taken down in about six minutes; roughly 300 people ran the worm and seven got unused API keys.
Danbooru said that on November 4 an attacker uploaded a malicious Flash post containing an XSS worm after Flash uploads were accidentally possible again. The worm showed a remote video that collected IP addresses, and for logged-in viewers it recorded usernames, tried to create API keys, repost itself and delete favorites. Operators say the servers were not compromised, the exploit was fixed, and the site stayed down about a week while they audited other issues.
Unconfirmed: Staff say there is no indication accounts remain compromised; their claim that the attacker used LLMs is not independently confirmed.
- About 600 page views, 300 worm runs, 100 of them by logged-in users.
- Backdoor API keys were created for seven recent logins, then deleted unused.
- Forty-eight users lost 1,000 favorites, which staff say were restored.
- Sixty-eight worm copies and 129 forum posts were removed.
- A one-line thumbnail pull request on October 28 re-enabled Flash uploads.
Impact: Viewer IPs taken and logged-in accounts briefly hijacked
| Product | Affected |
|---|---|
| Danbooru | — |
- 1.Change the account password and enable two-factor authentication.
- 2.Review login history and delete unrecognized API keys.
- Victims
- Danbooru
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| url | https://domain2doamin.duckdns.org/cdn/worm-video.flv | t do? This is what it did: • First it showed a video from hxxps://domain2doamin.duckdns.org/cdn/worm-video.flv. This grabbed your IP address (this is the attacker's site, |
From the original article
6 min read at danbooru.donmai.usWe are so back! Read here about the downtime and security incident. Registered members can now search up to three tags at once!
By danbooru.donmai.us via ettolrach · danbooru.donmai.us
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.