Mastodon vulnerabilities

Mastodon, a free, open-source social network server based on ActivityPub, has a vulnerability in its protection mechanism that blocks requests to local IP addresses. Some IP address ranges are missing, allowing an attacker to make Mastodon perform HTTP requests against loopback or local network hosts, potentially accessing private resources and services. This is fixed in Mastodon v4.5.4, v4.4.11, v4.3.17 and v4.2.29.

Mastodon, an ActivityPub-based social network server, has a vulnerability that allows attackers to create and overwrite arbitrary files in the system through carefully crafted media files. This affects versions from 3.5.0 to 3.5.8 and 4.0.0 to 4.1.2.

Mastodon, an ActivityPub-based social network server, has a vulnerability that allows attackers to bypass HTML sanitization using crafted oEmbed data. This enables the injection of arbitrary HTML into oEmbed preview cards, creating a vector for XSS attacks.

Vulnerability in Mastodon prior to versions 4.4.19 and 4.5.12. The ldap_authenticable.rb file mutates global OpenSSL parameters when LDAP uses LDAP_TLS_NO_VERIFY=true, disabling SSL/TLS certificate verification for puma web processes.

In Mastodon before versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.private_address? does not recognize IPv4-compatible IPv6 addresses, allowing an attacker to bypass ALLOWED_PRIVATE_ADDRESSES protection and send HTTP requests to loopback interfaces, potentially accessing private resources. Exploitation requires a system supporting the obsolete IPv4-compatible IPv6 mechanism.

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally identifying information about another local user in a collection because the controller used the general collection policy instead of the admin collection policy namespace. The exposed data included the other user's current email address and last-used IP address. This issue is fixed in versions 4.6.4 and 4.7.0-beta.1.

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused long-running SQL queries in Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension, allowing repeated requests to exhaust server resources. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.

Mastodon prior to versions 4.5.11, 4.4.18, and 4.3.24 contains a DoS vulnerability due to missing exception handling in the math sanitizer. Malformed <math> nodes can lead to a DoS of the entire server or targeted user services, depending on the actions involving those nodes.

Mastodon, a social network server based on ActivityPub, has a vulnerability in versions from 4.3.0 to 4.5.11 and 4.4.18 that allows modification of the attributionDomains value in signed activities. An error in the definition of this term makes Linked Data signatures ineffective.

Prior to versions 4.5.10, 4.4.17, and 4.3.23, Mastodon's normalization of incoming activities signed with Linked-Data Signatures did not adequately protect against a certain class of spoofing, allowing threat actors to remove JSON entries from valid signed activities from third-party actors.

Mastodon prior to versions 4.5.10, 4.4.17, and 4.3.23 has a vulnerability that allows incorrect recognition of IPv4-mapped IPv6 addresses, potentially leading to TCP connections to private IPv4 addresses. Attackers can exploit this vulnerability by publishing appropriate DNS records.

Mastodon, a social network server based on ActivityPub, prior to versions 4.5.10, 4.4.17, and 4.3.23, improperly normalized incoming activities signed with Linked-Data Signatures, allowing attackers to manipulate valid signed JSON-LD activities from third-party actors.

Mastodon, a social network server based on ActivityPub, prior to versions 4.5.10, 4.4.17, and 4.3.23, had a vulnerability in the list of disallowed IP address ranges, allowing attackers to make HTTP requests to loopback interfaces. This could lead to unauthorized access to private resources and services.

In Mastodon, versions with a missing condition in the check for remote accounts' consent to be featured in a remote Collection allow attackers to bypass this check and fake consent. This can lead to a situation where an account appears to be allowed in a Collection when it actually is not.

Mastodon versions 4.2.27 and prior, 4.3.0-beta.1 through 4.3.14, 4.4.0-beta.1 through 4.4.9, 4.5.0-beta.1 through 4.5.2 have discrepancies in error handling that allow checking whether a given status exists by sending a request with a non-English Accept-Language header. An attacker who knows the identifier of a status they are not allowed to see can confirm whether it exists. This cannot be used to learn the contents or any other property besides existence.

Mastodon version 4.4 added support for verifiable quote posts with quote controls, but in versions prior to 4.4.8 and 4.5.0-beta.2 an attacker can bypass these controls. Since reblogs are internally treated as statuses, an attacker could reblog any post, then quote their reblog, technically quoting themselves but having the quote feature preview a post they were not authorized for. The issue is patched in versions 4.4.8 and 4.5.0-beta.2.

In Mastodon before 4.4.6, 4.3.14, and 4.2.27, the streaming server accepts serving events for public timelines to clients using any valid authentication token, even if those tokens lack the read:statuses scope. This allows OAuth clients without the read scope to subscribe to public channels and receive public timeline events.

In Mastodon before versions 4.4.6, 4.3.14, and 4.2.27, disabling or suspending a user account does not disconnect the account from the streaming API. Such accounts can continue receiving real-time updates through existing streaming connections and establish new streaming connections.

In Mastodon before 4.4.6, 4.3.14, and 4.2.27, when an administrator resets a user account's password via the command-line interface using `bin/tootctl accounts modify --reset-password`, active sessions and access tokens for that account are not revoked. This allows an attacker with access to a previously compromised session or token to continue using the account after the password reset. The issue is patched in 4.2.27, 4.3.14, and 4.4.6; no known workarounds exist.

Mastodon, a social network server based on ActivityPub, has a vulnerability that allows an attacker to craft a verified profile link that misleads users about the actual URL. Versions from 2.6.0 to prior to 3.5.9, 4.0.5, and 4.1.3 are affected.

Mastodon, an ActivityPub-based social network server, is vulnerable to slowloris-type attacks that can lead to server unresponsiveness. In versions prior to 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the response time, keeping all Mastodon workers busy for an extended duration.