Crumb
c/fediverse · by cypherpunks@lemmy.ml · 2y

Mastodon security update: every version prior to today's is vulnerable to remote user impersonation and takeover

https://github.com/mastodon/mastodon/security/advisories/GHSA-3fjr-858r-92rw

181 points · 12 comments · view on lemmy.world

12 Comments

redcalcium@lemmy.institute · 28 pts · 2y (6 replies)

This advisory will be edited with more details on 2024/02/15, when admins have been given some time to update, as we think any amount of detail would make it very easy to come up with an exploit.

But the commit to fix insufficient origin validation is already visible right there in the repo?

losttourist@kbin.social · 30 pts · 2y (5 replies)

Without a published POC there's a slightly longer window before clueless script kiddies start having a go at exploiting the vulnerability, though.

fartsparkles@sh.itjust.works · 5 pts · 2y (4 replies)

Script kiddies aren’t the first ones to take advantage of vulns, threat actors are.

jmcs@discuss.tchncs.de · 8 pts · 2y (3 replies)

That doesn't mean you shouldn't try to contain the blast radius.

fartsparkles@sh.itjust.works · 3 pts · 2y (2 replies)
[ removed ]
cheviotveneer@sh.itjust.works · 2 pts · 2y (1 reply)

private repo they commit to and build from

This isn't possible with Ruby and Mastodon. The only way to distribute the patch is to reveal the changes to the source. FWIW, compiling the fix is still just an obfuscation method, one can still just diff the binaries and see what changed (see: reverse-engineering Windows vulnerabilities in updates).

At best, you can release it with a bunch of unrelated and obfuscating changes, but putting work into doing that is further delaying simply getting the fix released.

fartsparkles@sh.itjust.works · 1 pts · 2y
[ removed ]
desmosthenes@lemmy.world · 7 pts · 2y

hope for the best; plan for the worst

AngieStone@mastodon.social · 6 pts · 2y (1 reply)

@cypherpunks
German news:
https://www.heise.de/news/Mastodon-Diebstahl-beliebiger-Identitaeten-im-foederierten-Kurznachrichtendienst-9615961.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege

androidul@lemmy.ml · 1 pts · 2y

nett hier

fembot@mstdn.social · 2 pts · 2y
[ removed ]
steter@mastodon.stevesworld.co · 2 pts · 2y

@cypherpunks Upgrading went smoothly.

Atelopus-zeteki@kbin.run · -3 pts · 2y (2 replies)

Hmm, so if one is on iOS, the current version 2023.16, and is vulnerable. Take note apple / mac folx.

cypherpunks@lemmy.ml · 19 pts · 2y (1 reply)

No, this is a server-side vulnerability. Clients do not need to update, instances do.

Atelopus-zeteki@kbin.run · 2 pts · 2y

TY!