by Kastro
Paper/Archive/CVE-2023-36460

CVE-2023-36460

mastodon mastodon — Mastodon vulnerable to arbitrary file creation through media attachments

EPSS 40%CVSS 10.0
critical.is priorityof 100
50
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 98.6.986 × 2019.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, attackers using carefully crafted media files can cause Mastodon's media processing code to create arbitrary files at any location. This allows attackers to create and overwrite any file Mastodon has access to, allowing Denial of Service and arbitrary Remote Code Execution. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

Affected

ProductAffectedFixed inSource
mastodon>= 3.5.0, < 3.5.9–CNA
mastodon>= 4.0.0, < 4.0.5–CNA
mastodon>= 4.1.0, < 4.1.3–CNA

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/mastodon/mastodon/security/advisories/GHSA-9928-3cp5-93fmrefgithub.com/mastodon/mastodon/commit/dc8f1fbd976ae544720a4e07120d9a91b2722440refgithub.com/mastodon/mastodon/releases/tag/v3.5.9refgithub.com/mastodon/mastodon/releases/tag/v4.0.5refgithub.com/mastodon/mastodon/releases/tag/v4.1.3refopenwall.com/lists/oss-security/2023/07/06/4