Lucene search

GoogleOSV:BIT-MASTODON-2023-42450

HistoryMar 06, 2024 - 10:56 a.m.

BIT-mastodon-2023-42450

2024-03-0610:56:05

Google

osv.dev

mastodon

remote data injection

activitypub

confused deputy attacks

server configuration

local exploitable services

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

49.1%

JSON

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specific input, attackers can inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused deputy attacks if the server configuration includes ALLOWED_PRIVATE_ADDRESSES to allow access to local exploitable services. Version 4.2.0-rc2 has a patch for the issue.

References

github.com/mastodon/mastodon/commit/94893cf24fc95b32cc7a756262acbe008c20a9d2

github.com/mastodon/mastodon/security/advisories/GHSA-hcqf-fw2r-52g4

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

49.1%

JSON

Related for OSV:BIT-MASTODON-2023-42450