Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, attackers using carefully crafted media files can cause Mastodon's media processing code to create arbitrary files at any location. This allows attackers to create and overwrite any file Mastodon has access to, allowing Denial of Service and arbitrary Remote Code Execution. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

According to its self-reported version number, the Mastodon application running on the remote host is prior to 3.5.9 or 4.0.x prior to 4.0.5 or 4.1.x prior to 4.1.3. It is, therefore, affected by multiples vulnerabilities :

- Verified profile links can be formatted in a misleading way - Denial of Service through slow HTTP responses - Arbitrary file creation through media attachments - XSS through oEmbed preview cards

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
114492	Mastodon 4.1.x < 4.1.3 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
114491	Mastodon 4.0.x < 4.0.5 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
114490	Mastodon < 3.5.9 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical

Detections

Analytics

CVE-2023-36460

critical

Tenable Plugins

critical

critical

critical