Mastodon up to 3.5.16/4.0.12/4.1.12/4.2.4 LDAP Authentication authentication spoofing

Summaryinfo

A vulnerability classified as critical has been found in Mastodon up to 3.5.16/4.0.12/4.1.12/4.2.4. Impacted is an unknown function of the component LDAP Authentication. The manipulation leads to authentication spoofing. This vulnerability is uniquely identified as CVE-2024-23832. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Mastodon up to 3.5.16/4.0.12/4.1.12/4.2.4. This issue affects some unknown processing of the component LDAP Authentication. The manipulation with an unknown input leads to a authentication spoofing vulnerability. Using CWE to declare the problem leads to CWE-290. This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version prior to 3.5.17 is vulnerable, as well as 4.0.x versions prior to 4.0.13, 4.1.x version prior to 4.1.13, and 4.2.x versions prior to 4.2.5.

The weakness was disclosed 02/01/2024. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2024-23832 since 01/22/2024. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 3.5.17, 4.0.13, 4.1.13 or 4.2.5 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Mastodon

Version

• 3.5.0
• 3.5.1
• 3.5.2
• 3.5.3
• 3.5.4
• 3.5.5
• 3.5.6
• 3.5.7
• 3.5.8
• 3.5.9
• 3.5.10
• 3.5.11
• 3.5.12
• 3.5.13
• 3.5.14
• 3.5.15
• 3.5.16
• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.0.5
• 4.0.6
• 4.0.7
• 4.0.8
• 4.0.9
• 4.0.10
• 4.0.11
• 4.0.12
• 4.1.0
• 4.1.1
• 4.1.2
• 4.1.3
• 4.1.4
• 4.1.5
• 4.1.6
• 4.1.7
• 4.1.8
• 4.1.9
• 4.1.10
• 4.1.11
• 4.1.12
• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3
• 4.2.4

License

• open-source

Website

• Product: https://github.com/mastodon/mastodon/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion