SB20261106114 - Multiple vulnerabilities in Mastodon

Description

This security bulletin contains information about 2 vulnerabilities.

1) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to cause denial of service in Mastodon by consuming processing resources with crafted activities.

The vulnerability exists due to Mastodon's JSON-LD processing performing an expensive operation on activity graphs before checking whether those graphs are too large. An unauthenticated remote attacker can submit crafted activities that each take up to several seconds to process without requiring victim interaction.

2) Improper Authentication (CVE-ID: N/A)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with a valid local account to bypass password authentication and access another inactive local account in Mastodon.

The vulnerability exists due to login logic allowing account switching mid-login without password verification, triggering a sign-in token email. An attacker with a valid local account can brute-force the six-character base64 token to access accounts with no activity within the past three months and no second-factor authentication.

Remediation

Install update from vendor's website.

References

• https://github.com/mastodon/mastodon/security/advisories/GHSA-cf49-73r7-rxj6
• https://github.com/mastodon/mastodon/security/advisories/GHSA-3xjw-gv43-3w62