Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker can craft a verified profile link using specific formatting to conceal arbitrary parts of the link, enabling it to appear to link to a different URL altogether. The link is visually misleading, but clicking on it will reveal the actual link. This can still be used for phishing, though, similar to IDN homograph attacks. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

According to its self-reported version number, the Mastodon application running on the remote host is prior to 3.5.9 or 4.0.x prior to 4.0.5 or 4.1.x prior to 4.1.3. It is, therefore, affected by multiples vulnerabilities :

- Verified profile links can be formatted in a misleading way - Denial of Service through slow HTTP responses - Arbitrary file creation through media attachments - XSS through oEmbed preview cards

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114492	Mastodon 4.1.x < 4.1.3 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114491	Mastodon 4.0.x < 4.0.5 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114490	Mastodon < 3.5.9 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2023-36462

medium

Tenable Plugins

critical

critical

critical