Critical vulnerability in Mastodon is pounced upon by fast-acting admins

Mastodon has called admins to action following the disclosure of a critical vulnerability affecting the decentralized social network favored by erstwhile Twitter lovers. With a 9.4 severity score, exploiting CVE-2024-23832 potentially allows attackers to take over Mastodon accounts remotely. While very little has been released by way of technical details – allowing admins time to patch before attackers devise exploits – vulnerabilities with such high CVSS scores tend to lead to severe consequences on the affected product and are often relatively easy to exploit. "Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account," said Eugen Rochko, CEO and lead developer at Mastodon, in a security advisory. "Every Mastodon version prior to 3.5.17 is vulnerable, as well as 4.0.x versions prior to 4.0.13, 4.1.x version prior to 4.1.13, and 4.2.x versions prior to 4.2.5." Rochko said that full details of the vulnerability will be published on February 15, giving admins two weeks to upgrade to the latest version. He said that the disclosure of "any amount of detail would make it very easy to come up with an exploit." Mastodon is a decentralized social network, meaning it runs on separate servers, independently owned and operated by their respective administrators. Although this brings benefits like enabling specific rules and restrictions for different communities, it also means each must be updated by the admins individually. It's ...