 Wowzers, that Mastodon CVE recently was quite something: β’ You can inject a post that is attributed to any remote user The full technical write up is worth a read: https://arcanican.is/excerpts/cve-2024-23832/discovery.htm 14 comments
@thisismissem Pleroma W
0
0
15 February at 22:15 | Open on tummy.town
 @thisismissem Wow, and there I thought (even with looking in the diff, granted I'm not familiar with Mastodon's codebase) it was just injecting weird posts that weren't actually made by the user.
At least I asserted correctly that Pleroma isn't vulnerable (I'd say it fundamentally can't, it all goes through the same validation process).  @thisismissem I was reading up to the point where it starts going on an unfounded rant against blockslists. nooooo thank you @charlag worth just ignoring that part. Everyone and their cousin whas opinions on blocklists and other things. (i.e., I'd suggest not throwing the baby out with the bath water) @thisismissem I mean, sure, opinions are a thing but when they align with people who enact racism and you cry cancel culture and actively inject it in a post this is a bit more than just an opinion innit. I'll probably still read it for technical details but dismissing these things too easilyβ¦ I don't feel so good about it. @charlag aye, but also, they could've easily verified if they were blocked: mastodon publishes its domain blocks publicly. It's probably just someone being angry about a feature that they don't understand.  @thisismissem @arcanicanis money quote: > But yet, Mozilla paid for a formal security audit of the Mastodon codebase, missed this, and yet this just tumbles into my lap. Great, I just resent the typical nature of the 'security consultancy' industry even more,  @SpaceLifeForm @thisismissem @jerry @paco arcanicanis posts an example of one of the maliciously-crafted payloads that resulted in a 9.8 severity CVE (CVE-2024-23832) against Mastodon at this post. https://were.social/objects/cfe6a3fd-17d5-439f-b81a-7d750baca280  @thisismissem I enjoyed the dig at Infosec.exchange in the post. @jerry aye, there's some very childish/silly remarks in the post imo, but hey, whatever. The meat of the post with regards to what the vulnerability was was the interesting part. @thisismissem indeed it was a good read. I just found the poke at us funny. βSomeone noticed us!β |
Gregory's Server