GHSA-mm4q-93gr-5mwc: ActivityPub Undo handler can unfollow or remove reposts on behalf of other accounts
ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the Undo handler allows a remote federated server to cause the service to act on a follow or repost as though the activity came from a different account. This permits removal of an existing follow relationship or repost belonging to another account without that account's involvement. No private data is exposed and content is not modified; the affected relationships can be re-established. Services proxying to Ghost's hosted ActivityPub server have already been updated, while self-hosted services require an updated image and redeployment. This issue is fixed in version 1.2.6.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ActivityPub server for Ghostto a version that resolves this vulnerability.Fixed in 1.2.6
Event History
Frequently Asked Questions
Which deployments need to take action?
Self-hosted ActivityPub services need an updated image and redeployment. Services that proxy to Ghost's hosted ActivityPub server have already been updated.
What must an attacker be able to do to exploit this?
An attacker needs to use a remote federated server to send an Undo activity. The vulnerable handler can then treat a follow or repost as if it originated from a different account.
What is the practical impact if exploited?
An attacker can remove an existing follow relationship or repost belonging to another account. Private data is not exposed, content is not modified, and affected relationships can be re-established.
What version fixes the issue?
The issue is fixed in ActivityPub version 1.2.6. Affected versions run from 1.0.0 until 1.2.6.