PT-2023-25578 · Mastodon · Mastodon

Narfed + 1 · Published 2023-07-06 · Updated 2024-03-06 · CVE-2023-36462

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mastodon versions 2.6.0 through 3.5.8 Mastodon versions 4.0.0 through 4.0.4 Mastodon versions 4.1.0 through 4.1.2

Description Mastodon is a free, open-source social network server based on ActivityPub. An attacker can craft a verified profile link using specific formatting to conceal arbitrary parts of the link, enabling it to appear to link to a different URL altogether. The link is visually misleading, but clicking on it will reveal the actual link. This can still be used for phishing, though, similar to IDN homograph attacks.

Recommendations For Mastodon versions 2.6.0 through 3.5.8, update to version 3.5.9 or later. For Mastodon versions 4.0.0 through 4.0.4, update to version 4.0.5 or later. For Mastodon versions 4.1.0 through 4.1.2, update to version 4.1.3 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BIT-MASTODON-2023-36462

CVE-2023-36462

GHSA-55J9-C3MP-6FCQ

Affected Products

Mastodon

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36462.json · Exploit
• https://github.com/mastodon/mastodon/commit/610731b03dfcadd887078cb0399f4e514aa1931c · Patch
• https://github.com/mastodon/mastodon/security/advisories/GHSA-55j9-c3mp-6fcq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-36462 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36462 · Security Note
• https://osv.dev/vulnerability/BIT-mastodon-2023-36462 · Vendor Advisory
• https://github.com/mastodon/mastodon/releases/tag/v4.1.3 · Note
• https://github.com/mastodon/mastodon/releases/tag/v4.0.5 · Note
• https://github.com/mastodon/mastodon/releases/tag/v3.5.9 · Note
• https://t.me/true_secator/4597 · Telegram Post
• https://t.me/cibsecurity/66164 · Telegram Post