Mastodon 4.2.5, 4.1.13 and 4.0.13 fix CVE-2024-23832, an origin validation flaw

Announced1 Feb 2024

Effective1 Feb 2024

StatusIn effect

What changed

On February 1, 2024 Mastodon released 4.2.5, 4.1.13 and 4.0.13 with one security fix: insufficient origin validation, tracked as CVE-2024-23832 (GHSA-3fjr-858r-92rw). The changelog entry gives no further technical detail; the linked GitHub advisory holds it.

What it means

Servers on older versions did not check strictly enough where incoming data came from. Mastodon fixed it in patched releases on February 1, 2024.

Who is affected

Mastodon server admins, and anyone whose account lives on a server running a version older than 4.2.5, 4.1.13 or 4.0.13.

What to do by 1 Feb 2024

Admins should run a patched version (4.2.5, 4.1.13 or 4.0.13 or later). Tool builders can check a server's version through /api/v2/instance before trusting it.

What this means for you

Mastodon servers talk to each other to share posts. A bug meant a server did not check carefully enough where the data it received really came from. Mastodon fixed it on February 1, 2024. If your account is on a server that has updated since then, you are fine.

The details

Fixed in: 4.2.5, 4.1.13 and 4.0.13, all dated February 1, 2024. Each release contains only this fix.
Changelog wording: "Fix insufficient origin validation (CVE-2024-23832, GHSA-3fjr-858r-92rw)".
The changelog does not describe the attack or which requests were affected. The GitHub advisory (linked above) is the place for that; it was not readable from our checker, so we have not summarised it.
The releases list no REST API changes, so publishing and scheduling clients need no code change.

What to do next

Business owners: Nothing, if your server updated. Ask your server admin if unsure.
Marketers and agencies: Nothing.
Developers: If you run a Mastodon server, run 4.2.5 or later. Tools can read the server version from /api/v2/instance.

Follow new entries with the RSS feed. Each platform also has its own feed, for example X or Meta.