Lucene search

GoogleOSV:CVE-2023-42450

HistorySep 19, 2023 - 4:15 p.m.

CVE-2023-42450

2023-09-1916:15:12

Google

osv.dev

mastodon

4.2.0-beta1

arbitrary data injection

http requests

confused deputy attacks

allowed_private_addresses

patch

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

49.1%

JSON

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specific input, attackers can inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused deputy attacks if the server configuration includes ALLOWED_PRIVATE_ADDRESSES to allow access to local exploitable services. Version 4.2.0-rc2 has a patch for the issue.

References

github.com/mastodon/mastodon/commit/94893cf24fc95b32cc7a756262acbe008c20a9d2

github.com/mastodon/mastodon/security/advisories/GHSA-hcqf-fw2r-52g4

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

49.1%

JSON

Related for OSV:CVE-2023-42450