CVE-2023-36462 Mastodon's verified profile links can be formatted in a misleading way
Attackers can craft misleading verified profile links to facilitate phishing attacks by concealing the true destination URL.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-36462?
CVE-2023-36462 is a medium-severity vulnerability in mastodon, published on 6 Jul 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker can craft a verified profile link using specific formatting to conceal arbitrary parts of the link, enabling it to appear to link to a different URL altogether. The link is visually misleading, but clicking on it will reveal the actual link. This can still be used for phishing, though, similar to IDN homograph attacks. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.
Weakness: CWE-20
Which versions are affected by CVE-2023-36462?
1 open source package ship an affected version, including mastodon. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mastodon Bitnami | From 2.6.0 | 3.5.9, 4.0.5, 4.1.3 |
Products include Joinmastodon Mastodon.
How do I fix CVE-2023-36462?
Upgrade mastodon to a fixed version for your release line: 3.5.9, 4.0.5 or 4.1.3.
Is CVE-2023-36462 being exploited?
There is no known exploitation of CVE-2023-36462 in the wild and no public exploit code.
Other vulnerabilities in mastodon
- CVE-2023-36460 Mastodon vulnerable to arbitrary file creation through media attachments
- CVE-2022-2166 Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon
- CVE-2022-24307 Missing authorization in n/a
- CVE-2018-21018 Auth bypass in n/a
- CVE-2024-23832 Mastodon Remote user impersonation and takeover
Sources
Also known as BIT-mastodon-2023-36462, GHSA-55j9-c3mp-6fcq.