Embed Notice

• v4.2.5 was released to fix CVE-2024-23832 (the one I reported)
• v4.2.6 was released to fix CVE-2024-25618 (External OpenID Connect Account Takeover by E-Mail Change, credit to @nik and @pinguin )
• v4.2.7 was released to fix a not-yet-public Github security report: https://github.com/mastodon/mastodon/security/advisories/GHSA-jhrq-qvrm-qr36

The update of v4.2.5 addressed the specific payloads I had put together, as it was confirmed fixed in my test lab. But I wouldn’t be surprised if there was more, such as if it was something to do with attributedTo or other properties that I could have overlooked.

I was already blown away by the point that I could do the first attack (of impersonated posts) so trivially, and then tumbling down the rabbit hole of noticing I could alter profiles too, and then even hijacking traffic outbound, and rejecting genuine traffic on the inbound—that there was probably even more yet to be discovered still, that someone else caught instead.

I can probably poke around with v4.2.5 more in a moment, to see if there was other trivial vulnerabilities overlooked.