Mastodon vulnerabilities

Vulnerability in Mastodon prior to versions 4.4.19 and 4.5.12. The ldap_authenticable.rb file mutates global OpenSSL parameters when LDAP uses LDAP_TLS_NO_VERIFY=true, disabling SSL/TLS certificate verification for puma web processes.

Mastodon, a free, open-source social network server based on ActivityPub, has a vulnerability in its protection mechanism that blocks requests to local IP addresses. Some IP address ranges are missing, allowing an attacker to make Mastodon perform HTTP requests against loopback or local network hosts, potentially accessing private resources and services. This is fixed in Mastodon v4.5.4, v4.4.11, v4.3.17 and v4.2.29.

Mastodon, an ActivityPub-based social network server, has a vulnerability that allows attackers to create and overwrite arbitrary files in the system through carefully crafted media files. This affects versions from 3.5.0 to 3.5.8 and 4.0.0 to 4.1.2.

Mastodon, an ActivityPub-based social network server, has a vulnerability that allows attackers to bypass HTML sanitization using crafted oEmbed data. This enables the injection of arbitrary HTML into oEmbed preview cards, creating a vector for XSS attacks.

In Mastodon before versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.private_address? does not recognize IPv4-compatible IPv6 addresses, allowing an attacker to bypass ALLOWED_PRIVATE_ADDRESSES protection and send HTTP requests to loopback interfaces, potentially accessing private resources. Exploitation requires a system supporting the obsolete IPv4-compatible IPv6 mechanism.

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally identifying information about another local user in a collection because the controller used the general collection policy instead of the admin collection policy namespace. The exposed data included the other user's current email address and last-used IP address. This issue is fixed in versions 4.6.4 and 4.7.0-beta.1.

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused long-running SQL queries in Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension, allowing repeated requests to exhaust server resources. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.

Mastodon prior to versions 4.5.11, 4.4.18, and 4.3.24 contains a DoS vulnerability due to missing exception handling in the math sanitizer. Malformed <math> nodes can lead to a DoS of the entire server or targeted user services, depending on the actions involving those nodes.

Mastodon, a social network server based on ActivityPub, has a vulnerability in versions from 4.3.0 to 4.5.11 and 4.4.18 that allows modification of the attributionDomains value in signed activities. An error in the definition of this term makes Linked Data signatures ineffective.

Prior to versions 4.5.10, 4.4.17, and 4.3.23, Mastodon's normalization of incoming activities signed with Linked-Data Signatures did not adequately protect against a certain class of spoofing, allowing threat actors to remove JSON entries from valid signed activities from third-party actors.

Mastodon prior to versions 4.5.10, 4.4.17, and 4.3.23 has a vulnerability that allows incorrect recognition of IPv4-mapped IPv6 addresses, potentially leading to TCP connections to private IPv4 addresses. Attackers can exploit this vulnerability by publishing appropriate DNS records.

Mastodon, a social network server based on ActivityPub, prior to versions 4.5.10, 4.4.17, and 4.3.23, improperly normalized incoming activities signed with Linked-Data Signatures, allowing attackers to manipulate valid signed JSON-LD activities from third-party actors.

Mastodon, a social network server based on ActivityPub, prior to versions 4.5.10, 4.4.17, and 4.3.23, had a vulnerability in the list of disallowed IP address ranges, allowing attackers to make HTTP requests to loopback interfaces. This could lead to unauthorized access to private resources and services.

In Mastodon, versions with a missing condition in the check for remote accounts' consent to be featured in a remote Collection allow attackers to bypass this check and fake consent. This can lead to a situation where an account appears to be allowed in a Collection when it actually is not.

Mastodon, a social network server based on ActivityPub, has a vulnerability that allows an attacker to craft a verified profile link that misleads users about the actual URL. Versions from 2.6.0 to prior to 3.5.9, 4.0.5, and 4.1.3 are affected.

Mastodon, an ActivityPub-based social network server, is vulnerable to slowloris-type attacks that can lead to server unresponsiveness. In versions prior to 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the response time, keeping all Mastodon workers busy for an extended duration.