CVE-2023-36459
CriticalCVSS 9.3Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
Mastodon, an ActivityPub-based social network server, has a vulnerability that allows attackers to bypass HTML sanitization using crafted oEmbed data. This enables the injection of arbitrary HTML into oEmbed preview cards, creating a vector for XSS attacks.
Risk Assessment
This vulnerability can lead to the execution of malicious code in users' browsers, threatening data security and user privacy. Attackers may exploit this vulnerability for phishing attacks or data theft.
Recommendation
It is recommended to update Mastodon to versions 3.5.9, 4.0.5, or 4.1.3, which contain a patch for this vulnerability. Additionally, users should be monitored and educated about potential threats related to clicking on unknown links.
Original NVD description (English source)
Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker using carefully crafted oEmbed data can bypass the HTML sanitization performed by Mastodon and include arbitrary HTML in oEmbed preview cards. This introduces a vector for cross-site scripting (XSS) payloads that can be rendered in the user's browser when a preview card for a malicious link is clicked through. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.