CVE-2023-42450: Mastodon Server-Side Request Forgery vulnerability

Published Sep 19, 2023

Updated

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specific input, attackers can inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused deputy attacks if the server configuration includes ALLOWEDPRIVATEADDRESSES to allow access to local exploitable services. Version 4.2.0-rc2 has a patch for the issue.

Affected Software

4 affected components

Joinmastodon Mastodon=4.2.0-beta1

Joinmastodon Mastodon=4.2.0-beta2

Joinmastodon Mastodon=4.2.0-beta3

Joinmastodon Mastodon=4.2.0-rc1

Remediation

Patch Available

https://github.com/mastodon/mastodon/commit/94893cf24fc95b32cc7a756262acbe008c20a9d2

Event History

Sep 19, 2023

CVE Published

via MITRE·03:53 PM

Data Sourced

via MITRE·03:53 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2023-42450?

CVE-2023-42450 is a vulnerability in Mastodon that allows attackers to inject arbitrary data into HTTP requests.

How does CVE-2023-42450 affect Mastodon?

CVE-2023-42450 affects Mastodon versions 4.2.0-beta1 to 4.2.0-rc2.

What is the severity of CVE-2023-42450?

CVE-2023-42450 has a severity rating of 7.5 out of 10 (high).

How can attackers exploit CVE-2023-42450?

Attackers can exploit CVE-2023-42450 by crafting specific input to inject arbitrary data into HTTP requests issued by Mastodon.

How can I fix CVE-2023-42450?

To fix CVE-2023-42450, it is recommended to update Mastodon to version 4.2.0-rc2 or later.