PT-2023-6629 · Mastodon · Mastodon

Scumjr · Published 2023-09-19 · Updated 2024-03-06 · CVE-2023-42450

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mastodon versions 4.2.0-beta1 through 4.2.0-rc1

Description The issue is related to insufficient request validation on the server side, allowing attackers to inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused deputy attacks if the server configuration includes ALLOWED PRIVATE ADDRESSES to allow access to local exploitable services.

Recommendations For Mastodon versions 4.2.0-beta1 through 4.2.0-rc1, update to version 4.2.0-rc2 or later to resolve the issue. As a temporary workaround, consider restricting access to local services by removing or limiting the ALLOWED PRIVATE ADDRESSES configuration to minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-113

CWE-918

Related Identifiers

BDU:2023-07396

BIT-MASTODON-2023-42450

CVE-2023-42450

GHSA-HCQF-FW2R-52G4

Affected Products

Mastodon

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42450.json · Exploit
• https://github.com/mastodon/mastodon/security/advisories/GHSA-hcqf-fw2r-52g4 · Vendor Advisory
• https://github.com/mastodon/mastodon/commit/94893cf24fc95b32cc7a756262acbe008c20a9d2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-42450 · Security Note
• https://osv.dev/vulnerability/BIT-mastodon-2023-42450 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-42450 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07396 · Security Note
• https://twitter.com/CVEnew/status/1704168531015651820 · Twitter Post
• https://t.me/cvenotify/58455 · Telegram Post
• https://t.me/cibsecurity/70743 · Telegram Post
• https://t.me/cybersecuritytechnologies/9247 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42450 · Note
• https://t.me/cvenotify/71812 · Telegram Post
• https://twitter.com/ksg93rd/status/1716446444612460793 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1704202402188996970 · Twitter Post