BIT-mastodon-2023-42452

    Dashboard / Vulnerabilities / BIT-mastodon-2023-42452

    BIT-mastodon-2023-42452

    Published: 6 Mar 2024Last Modified: 8 Sept 2026

    Summary: Mastodon vulnerable to Stored XSS through the translation feature

    Details: Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.x branch prior to versions 4.0.10, 4.2.8, and 4.2.0, under certain conditions, attackers can abuse the translation feature to bypass the server-side HTML sanitization, allowing unescaped HTML to execute in the browser. The impact is limited thanks to Mastodon's strict Content Security Policy, blocking inline scripts, etc. However a CSP bypass or loophole could be exploited to execute malicious XSS. Furthermore, it requires user interaction, as this can only occur upon clicking the “Translate” button on a malicious post. Versions 4.0.10, 4.2.8, and 4.2.0 contain a patch for this issue.

    References: https://github.com/mastodon/mastodon/commit/ff32475f5f4a84ebf9619e7eef5bf8b4c075d0e2, https://github.com/mastodon/mastodon/security/advisories/GHSA-2693-xr3m-jhqr, https://nvd.nist.gov/vuln/detail/CVE-2023-42452

    Affected packages

    Package

    Name: mastodon

    Purl: pkg:bitnami/mastodon

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 4.0.0
    Fixed -4.0.10

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-mastodon-2023-42452 | CVE-DB