CVE-2022-46405 Denial of service in n/a
Attackers can cause denial of service in Mastodon by creating bot accounts that trigger uncontrolled recursion in the Sidekiq pull queue.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-46405?
CVE-2022-46405 is a high-severity denial of service vulnerability in n/a, published on 4 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-controlled accounts on certain other servers associated with a wildcard DNS A record, such that there is uncontrolled recursion of attacker-generated messages.
Weakness: CWE-674
Which versions are affected by CVE-2022-46405?
1 open source package ship an affected version, including mastodon. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mastodon Bitnami | All versions | 4.0.3 |
Products include Joinmastodon Mastodon.
How do I fix CVE-2022-46405?
Upgrade mastodon to 4.0.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-46405 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-46405 exists.
Other vulnerabilities in n/a
- CVE-2023-36460 Mastodon vulnerable to arbitrary file creation through media attachments
- CVE-2022-2166 Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon
- CVE-2022-24307 Missing authorization in n/a
- CVE-2018-21018 Auth bypass in n/a
- CVE-2024-23832 Mastodon Remote user impersonation and takeover
Sources
Also known as BIT-mastodon-2022-46405, GHSA-8f7g-vmw6-89m7.