Imgur vulnerability exploited in attack on 4chan

Image sharing service Imgur suffered from a vulnerability that allowed malicious code to be added to image links. The exploit led to a ddos ​​attack on 4chan and 8chan, and potentially left malware on the PCs of users of those sites.

Imgur confirms the leak and says it has taken steps to patch it. “After analysis by our team, it appears that the exploit targeted 4chan and 8chan users specifically, with images shared via a specific sub-reddit using Imgur’s hosting and sharing tools,” the site reads.

According to Imgur, the vulnerability made it possible to inject malicious code into an image link. This involved javascript and according to Imgur’s CEO, Alan Schaaf, it is no longer possible to serve javascript code from i.imgur.com.

The code, according to Reddit users, caused when an Imgur image was loaded from r/4chan, hundreds of links to images from 4chan and 8chan were opened in the background. In addition to this ddos ​​attack, users reported a more damaging attack for users, which occurred in the background. The javascript code would surreptitiously open an iframe containing an Adobe Flash file that would bring even more javascript code to the affected person’s system and enable a connection to a web service.

The latter has not yet been confirmed and it is unclear what the purpose of this attack would be. Imgur recommends that users clear browsing data, cookies, and localstorage.