{"id":"BIT-mastodon-2024-25623","summary":"Lack of media type verification of Activity Streams objects allows impersonation of remote accounts","details":"Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19, when fetching remote statuses, Mastodon doesn't check that the response from the remote server has a `Content-Type` header value of the Activity Streams media type, which allows a threat actor to upload a crafted Activity Streams document to a remote server and make a Mastodon server fetch it, if the remote server accepts arbitrary user uploads. The vulnerability allows a threat actor to impersonate an account on a remote server that satisfies all of the following properties: allows the attacker to register an account; accepts arbitrary user-uploaded documents and places them on the same domain as the ActivityPub actors; and serves user-uploaded document in response to requests with an `Accept` header value of the Activity Streams media type. Versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19 contain a fix for this issue.","aliases":["CVE-2024-25623","GHSA-jhrq-qvrm-qr36"],"modified":"2026-09-08T08:48:13.164381033Z","published":"2024-03-31T18:20:59.562Z","database_specific":{"cpes":["cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*"],"severity":"High"},"references":[{"type":"FIX","url":"https://github.com/mastodon/mastodon/commit/9fee5e852669e26f970e278021302e1a203fc022"},{"type":"ADVISORY","url":"https://github.com/mastodon/mastodon/security/advisories/GHSA-jhrq-qvrm-qr36"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25623"}],"affected":[{"package":{"name":"mastodon","ecosystem":"Bitnami","purl":"pkg:bitnami/mastodon"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.5.19"},{"introduced":"4.0.0"},{"fixed":"4.0.15"},{"introduced":"4.1.0"},{"fixed":"4.1.15"},{"introduced":"4.2.0"},{"fixed":"4.2.7"}]}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/mastodon/BIT-mastodon-2024-25623.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N"}]}],"schema_version":"1.9.0"}