Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19, when fetching remote statuses, Mastodon doesn't check that the response from the remote server has a `Content-Type` header value of the Activity Streams media type, which allows a threat actor to upload a crafted Activity Streams document to a remote server and make a Mastodon server fetch it, if the remote server accepts arbitrary user uploads. The vulnerability allows a threat actor to impersonate an account on a remote server that satisfies all of the following properties: allows the attacker to register an account; accepts arbitrary user-uploaded documents and places them on the same domain as the ActivityPub actors; and serves user-uploaded document in response to requests with an `Accept` header value of the Activity Streams media type. Versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19 contain a fix for this issue.

According to its self-reported version number, the version of Mastodon running on the remote host is prior to 3.5.19 or 4.0.x prior to 4.0.15 or 4.1.x prior to 4.1.15 or 4.2.x prior to 4.2.7. Therefore, it may be affected by a lack of media type verification of Activity Streams objects allows impersonation of remote accounts.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114479	Mastodon 4.2.x < 4.2.7 Unrestricted File Upload	Web App Scanning	Component Vulnerability	high
114478	Mastodon 4.1.x < 4.1.15 Unrestricted File Upload	Web App Scanning	Component Vulnerability	high
114477	Mastodon 4.0.x < 4.0.15 Unrestricted File Upload	Web App Scanning	Component Vulnerability	high
114476	Mastodon < 3.5.19 Unrestricted File Upload	Web App Scanning	Component Vulnerability	high

Detections

Analytics

CVE-2024-25623

high

Tenable Plugins

high

high

high

high