Remote user impersonation and takeover
github.com
### Summary Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version prior to 3.5.17 is vulnerable, as well as...
  • losttourist@kbin.social
    31·
    11 months ago

    Without a published POC there’s a slightly longer window before clueless script kiddies start having a go at exploiting the vulnerability, though.

      • jmcs
        9·
        11 months ago

        That doesn’t mean you shouldn’t try to contain the blast radius.

          • cheviotveneer@sh.itjust.works
            2·
            11 months ago

            private repo they commit to and build from

            This isn’t possible with Ruby and Mastodon. The only way to distribute the patch is to reveal the changes to the source. FWIW, compiling the fix is still just an obfuscation method, one can still just diff the binaries and see what changed (see: reverse-engineering Windows vulnerabilities in updates).

            At best, you can release it with a bunch of unrelated and obfuscating changes, but putting work into doing that is further delaying simply getting the fix released.