Mastodon vulnerability allows impersonation of remote server accounts

CVE-2024-25623

What is CVE-2024-25623?

Mastodon, an open-source social networking server built on the ActivityPub protocol, contains a vulnerability that arises when fetching remote statuses from other servers. Before the release of versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19, the server fails to validate the 'Content-Type' header in responses from remote servers. This oversight allows threat actors to upload maliciously crafted Activity Streams documents to a remote server. If certain conditions are met—such as the remote server permitting user registrations and uploads—attackers could exploit the vulnerability to impersonate other accounts. The affected versions have been patched to address this issue, highlighting the importance of keeping software up to date.

References