CVE-2024-23832: Mastodon: Remote user impersonation and takeover

[Valtteri Vuorikoski <vuori () notcom org>]

The Mastodon project [1] has published a Github advisory for a
high-severity issue which allows user impersonation and account
takeover with the identifier CVE-2024-23832. The team's Fediverse
postings indicate that everyone should urgently update their
instances. CVSS 3.1 is given as 9.4/10.

The advisory at
<https://github.com/mastodon/mastodon/security/advisories/GHSA-3fjr-858r-92rw>
states:

  Due to insufficient origin validation in all Mastodon, attackers can
  impersonate and take over any remote account.

  Every Mastodon version prior to 3.5.17 is vulnerable, as well as 4.0.x
  versions prior to 4.0.13, 4.1.x version prior to 4.1.13, and 4.2.x
  versions prior to 4.2.5.

Details are not currently posted, but an update on Feb 15 is
promised. Commit
<https://github.com/mastodon/mastodon/commit/a6641f828b9e6f5806be01754318279c2532ae82>
appears to be the fix.

 -Valtteri

[1] "Mastodon is a free, open-source social network server based on
ActivityPub where users can follow friends and discover new ones."