Mastodon Server-Side Request Forgery vulnerability

CVE-2023-42450

What is CVE-2023-42450?

Mastodon, a free and open-source social networking server based on the ActivityPub protocol, is vulnerable to arbitrary data injection in HTTP requests. This issue occurs in versions prior to 4.2.0-rc2, specifically starting from version 4.2.0-beta1. Attackers can exploit this vulnerability by crafting specific input that injects arbitrary data into the requests. If the server configuration permits access to local services through ALLOWED_PRIVATE_ADDRESSES, this vulnerability may lead to confused deputy attacks, where unauthorized actions are performed by the server on behalf of an attacker. Users are encouraged to upgrade to version 4.2.0-rc2 or later to mitigate this risk. For more details, visit the Mastodon security advisory.

References