Lemmy.World
  • Communities
  • Create Post
  • Create Community
  • heart
    Support Lemmy
  • search
    Search
  • Login
  • Sign Up
Edu4rdSHL to TechnologyEnglish ·
edit-2
2 years ago

Arbitrary file creation through media attachments on Mastodon

message-square
message-square
3
link
fedilink
65
message-square

Arbitrary file creation through media attachments on Mastodon

Edu4rdSHL to TechnologyEnglish ·
edit-2
2 years ago
message-square
3
link
fedilink

CVE-2023-36460 is a Mastodon vulnerability where you can send a toot which makes a webshell on instances that process said toot.

Edit: it’s already fixed, that’s why it was disclosed on GitHub.

The security advisory: https://github.com/mastodon/mastodon/security/advisories/GHSA-9928-3cp5-93fm

alert-triangle
You must log in or # to comment.
  • Nate@programming.dev
    link
    fedilink
    English
    arrow-up
    6
    ·
    2 years ago

    Not sure if this is related, but I think they pushed an update for it https://mastodon.social/@Mastodon/110667890329356603

    • Edu4rdSHLOP
      link
      fedilink
      English
      arrow-up
      5
      ·
      2 years ago

      Yes, it’s already fixed, that’s why it was disclosed on Github. I will edit the post to reflect that.

  • Lemmesee@lemm.ee
    link
    fedilink
    English
    arrow-up
    2
    arrow-down
    1
    ·
    2 years ago

    Woof

Technology

technology

Subscribe from Remote Instance

Create a post
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: [email protected]

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots


  • @[email protected]
  • @[email protected]
  • @[email protected]
  • @[email protected]
Visibility: Public
globe

This community can be federated to other instances and be posted/commented in by their users.

  • 4.12K users / day
  • 9.68K users / week
  • 17.1K users / month
  • 37.7K users / 6 months
  • 36.4K local subscribers
  • 70.9K subscribers
  • 15K Posts
  • 649K Comments
  • Modlog
  • mods:
  • L3s
  • enu
  • Technopagan
  • L4sBot
  • L3s@hackingne.ws
  • L4s@hackingne.ws
  • UI: 0.19.12-beta.0-4-g515eb451
  • BE: 0.19.11-19-g2895f45e8
  • Modlog
  • Legal
  • Instances
  • Docs
  • Code
  • join-lemmy.org