CVE-2024-37903 Mastodon has improper authorship check on audience extension for existing posts

What is CVE-2024-37903?

CVE-2024-37903 is a high-severity missing authorization vulnerability in mastodon, published on 5 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific activities, an attacker can extend the audience of a post they do not own to other Mastodon users on a target server, thus gaining access to the contents of a post not intended for them. Versions 4.1.18 and 4.2.10 contain a patch for this issue.

Weakness: CWE-862

Which versions are affected by CVE-2024-37903?

1 open source package ship an affected version, including mastodon. It affects 1 product.

Products include Joinmastodon Mastodon.

How do I fix CVE-2024-37903?

Upgrade mastodon to a fixed version for your release line: 4.1.18 or 4.2.10.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-37903 being exploited?

There is no known exploitation of CVE-2024-37903 in the wild and no public exploit code.

Other vulnerabilities in mastodon

• CVE-2023-36460 Mastodon vulnerable to arbitrary file creation through media attachments Critical 10.0
• CVE-2022-2166 Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon Critical 9.8
• CVE-2022-24307 Missing authorization in n/a Critical 9.8
• CVE-2018-21018 Auth bypass in n/a Critical 9.8
• CVE-2024-23832 Mastodon Remote user impersonation and takeover Critical 9.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-mastodon-2024-37903, GHSA-xjvf-fm67-4qc3.