PT-2024-2574 · Mastodon · Mastodon

Thisismissem · Published 2024-02-14 · Updated 2024-12-18 · CVE-2024-25619

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 3.5.18 Mastodon versions prior to 4.0.14 Mastodon versions prior to 4.1.14 Mastodon versions prior to 4.2.6

Description The issue is related to the incorrect handling of Access Tokens when an OAuth Application is destroyed. This could have allowed an application to continue listening to streaming after it had been destroyed, potentially posing security risks to users. The problem arises from the dependent: delete all configuration used by Doorkeeper, which prevents the after commit callback from firing. As a result, the streaming server is not informed that the Access Tokens have been destroyed. The impact is considered negligible since the affected application had to be owned by the user.

Recommendations For Mastodon versions prior to 3.5.18, upgrade to version 3.5.18 or later. For Mastodon versions prior to 4.0.14, upgrade to version 4.0.14 or later. For Mastodon versions prior to 4.1.14, upgrade to version 4.1.14 or later. For Mastodon versions prior to 4.2.6, upgrade to version 4.2.6 or later.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

CWE-672

Related Identifiers

BDU:2024-02629

BIT-MASTODON-2024-25619

CVE-2024-25619

GHSA-7W3C-P9J8-MQ3X

Affected Products

Mastodon

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25619.json · Exploit
• https://github.com/mastodon/mastodon/security/advisories/GHSA-7w3c-p9j8-mq3x · Vendor Advisory
• https://github.com/mastodon/mastodon/commit/68eaa804c9bafdc5f798e114e9ba00161425dd71 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-25619 · Security Note
• https://osv.dev/vulnerability/CVE-2024-25619 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mastodon-2024-25619 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02629 · Security Note
• https://github.com/mastodon/mastodon/releases/tag/v4.0.14 · Note
• https://github.com/mastodon/mastodon/releases/tag/v3.5.18 · Note
• https://github.com/mastodon/mastodon/releases/tag/v4.1.14 · Note
• https://github.com/mastodon/mastodon/releases/tag/v4.2.6 · Note
• https://twitter.com/CVEnew/status/1757875845077585949 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1757911240914203082 · Twitter Post
• https://t.me/cvenotify/104816 · Telegram Post