PT-2023-6629 · Mastodon · Mastodon

Scumjr · Publicado 2023-09-19 · Atualizado 2024-03-06 · CVE-2023-42450

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mastodon versions 4.2.0-beta1 through 4.2.0-rc1

Description The issue is related to insufficient request validation on the server side, allowing attackers to inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused deputy attacks if the server configuration includes ALLOWED PRIVATE ADDRESSES to allow access to local exploitable services.

Recommendations For Mastodon versions 4.2.0-beta1 through 4.2.0-rc1, update to version 4.2.0-rc2 or later to resolve the issue. As a temporary workaround, consider restricting access to local services by removing or limiting the ALLOWED PRIVATE ADDRESSES configuration to minimize the risk of exploitation.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-113

CWE-918

Identificadores relacionados

BDU:2023-07396

BIT-MASTODON-2023-42450

CVE-2023-42450

GHSA-HCQF-FW2R-52G4

Produtos afetados

Mastodon

Referências · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42450.json · Exploit
• https://github.com/mastodon/mastodon/security/advisories/GHSA-hcqf-fw2r-52g4 · Aviso do Fabricante
• https://github.com/mastodon/mastodon/commit/94893cf24fc95b32cc7a756262acbe008c20a9d2 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-42450 · Nota de Segurança
• https://twitter.com/CVEnew/status/1704168531015651820 · Publicação no Twitter
• https://t.me/cvenotify/58455 · Publicação no Telegram
• https://t.me/cibsecurity/70743 · Publicação no Telegram
• https://t.me/cybersecuritytechnologies/9247 · Publicação no Telegram
• https://osv.dev/vulnerability/BIT-mastodon-2023-42450 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42450 · Nota
• https://t.me/cvenotify/71812 · Publicação no Telegram
• https://twitter.com/ksg93rd/status/1716446444612460793 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1704202402188996970 · Publicação no Twitter
• https://twitter.com/PentestingN/status/1716341419432947718 · Publicação no Twitter
• https://t.me/cvenotify/58551 · Publicação no Telegram