arcanicanis on Nostr: v4.2.5 was released to fix CVE-2024-23832 (the one I reported) v4.2.6 was released to ...
v4.2.5 was released to fix CVE-2024-23832 (the one I reported) v4.2.6 was released to fix CVE-2024-25618 (External OpenID Connect Account Takeover by E-Mail Change, credit to npub16u3t88ncfra2h5z38p9vqm2whx6q55mscd42a8e9eua7e0lmhhaqfktnqn (npub16u3…tnqn) ) v4.2.7 was released to add a not-yet-public Github security report: https://github.com/mastodon/mastodon/security/advisories/GHSA-jhrq-qvrm-qr36
The update of v4.2.5 addressed the specific payloads I had put together, as it was confirmed fixed in my test lab. But I wouldn’t be surprised if there was more, such as if it was something to do with attributedTo or other properties that I could have overlooked.
I was already blown away by the point that I could do the first attack (of impersonated posts) so trivially, and then tumbling down the rabbit hole of noticing I could alter profiles too, and then even hijacking traffic outbound, and rejecting genuine traffic on the inbound—that there was probably even more yet to be discovered still, that someone else caught instead.
I can probably poke around with v4.2.5 more in a moment, to see if there was other trivial vulnerabilities overlooked.
The update of v4.2.5 addressed the specific payloads I had put together, as it was confirmed fixed in my test lab. But I wouldn’t be surprised if there was more, such as if it was something to do with attributedTo or other properties that I could have overlooked.
I was already blown away by the point that I could do the first attack (of impersonated posts) so trivially, and then tumbling down the rabbit hole of noticing I could alter profiles too, and then even hijacking traffic outbound, and rejecting genuine traffic on the inbound—that there was probably even more yet to be discovered still, that someone else caught instead.
I can probably poke around with v4.2.5 more in a moment, to see if there was other trivial vulnerabilities overlooked.