{"id":"CVE-2024-25623","aliases":["BIT-mastodon-2024-25623","EUVD-2024-22944","GHSA-jhrq-qvrm-qr36"],"status":"published","title":"Lack of media type verification of Activity Streams objects allows impersonation of remote accounts","description":"Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19, when fetching remote statuses, Mastodon doesn't check that the response from the remote server has a `Content-Type` header value of the Activity Streams media type, which allows a threat actor to upload a crafted Activity Streams document to a remote server and make a Mastodon server fetch it, if the remote server accepts arbitrary user uploads. The vulnerability allows a threat actor to impersonate an account on a remote server that satisfies all of the following properties: allows the attacker to register an account; accepts arbitrary user-uploaded documents and places them on the same domain as the ActivityPub actors; and serves user-uploaded document in response to requests with an `Accept` header value of the Activity Streams media type. Versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19 contain a fix for this issue.","severity":{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00511,"percentile":0.44028,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-434"],"published":"2024-02-19T15:28:15Z","modified":"2026-10-28T02:30:21Z","fixes":[{"ecosystem":"Bitnami","package":"mastodon","fixed_in":["3.5.19","4.0.15","4.1.15","4.2.7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"mastodon","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.5.19"},{"introduced":"4.0.0"},{"fixed":"4.0.15"},{"introduced":"4.1.0"},{"fixed":"4.1.15"},{"introduced":"4.2.0"},{"fixed":"4.2.7"}]}]}],"products":[{"vendor":"joinmastodon","product":"mastodon"},{"vendor":"mastodon","product":"mastodon"}],"references":[{"url":"https://github.com/mastodon/mastodon/security/advisories/GHSA-jhrq-qvrm-qr36","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/mastodon/mastodon/commit/9fee5e852669e26f970e278021302e1a203fc022","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25623","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25623.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-25623","title":"Lack of media type verification of Activity Streams objects allows impersonation of remote accounts","description":"Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19, when fetching remote statuses, Mastodon doesn't check that the response from the remote server has a `Content-Type` header value of the Activity Streams media type, which allows a threat actor to upload a crafted Activity Streams document to a remote server and make a Mastodon server fetch it, if the remote server accepts arbitrary user uploads. The vulnerability allows a threat actor to impersonate an account on a remote server that satisfies all of the following properties: allows the attacker to register an account; accepts arbitrary user-uploaded documents and places them on the same domain as the ActivityPub actors; and serves user-uploaded document in response to requests with an `Accept` header value of the Activity Streams media type. Versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19 contain a fix for this issue.","status":"published","published":"2024-02-19T15:28:15.296Z","modified":"2024-08-01T23:44:09.828Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:34:04.341725Z"}],"euvd":[{"id":"EUVD-2024-22944","description":"Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19, when fetching remote statuses, Mastodon doesn't check that the response from the remote server has a `Content-Type` header value of the Activity Streams media type, which allows a threat actor to upload a crafted Activity Streams document to a remote server and make a Mastodon server fetch it, if the remote server accepts arbitrary user uploads. The vulnerability allows a threat actor to impersonate an account on a remote server that satisfies all of the following properties: allows the attacker to register an account; accepts arbitrary user-uploaded documents and places them on the same domain as the ActivityPub actors; and serves user-uploaded document in response to requests with an `Accept` header value of the Activity Streams media type. Versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19 contain a fix for this issue.","status":"published","published":"2024-02-19T15:28:15Z","modified":"2024-08-01T23:44:09Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T03:50:27.742015Z"}],"nvd":[{"id":"CVE-2024-25623","description":"Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19, when fetching remote statuses, Mastodon doesn't check that the response from the remote server has a `Content-Type` header value of the Activity Streams media type, which allows a threat actor to upload a crafted Activity Streams document to a remote server and make a Mastodon server fetch it, if the remote server accepts arbitrary user uploads. The vulnerability allows a threat actor to impersonate an account on a remote server that satisfies all of the following properties: allows the attacker to register an account; accepts arbitrary user-uploaded documents and places them on the same domain as the ActivityPub actors; and serves user-uploaded document in response to requests with an `Accept` header value of the Activity Streams media type. Versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19 contain a fix for this issue.","status":"published","published":"2024-02-19T16:15:51.847Z","modified":"2026-06-17T07:16:18.837Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:09:37.655131Z"}],"osv":[{"id":"CVE-2024-25623","title":"Lack of media type verification of Activity Streams objects allows impersonation of remote accounts","description":"Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19, when fetching remote statuses, Mastodon doesn't check that the response from the remote server has a `Content-Type` header value of the Activity Streams media type, which allows a threat actor to upload a crafted Activity Streams document to a remote server and make a Mastodon server fetch it, if the remote server accepts arbitrary user uploads. The vulnerability allows a threat actor to impersonate an account on a remote server that satisfies all of the following properties: allows the attacker to register an account; accepts arbitrary user-uploaded documents and places them on the same domain as the ActivityPub actors; and serves user-uploaded document in response to requests with an `Accept` header value of the Activity Streams media type. Versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19 contain a fix for this issue.","status":"published","published":"2024-02-19T15:28:15.296Z","modified":"2026-10-28T02:30:21.37671832Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","level":"high"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:44:38.897406Z"},{"id":"BIT-mastodon-2024-25623","title":"Lack of media type verification of Activity Streams objects allows impersonation of remote accounts","description":"Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19, when fetching remote statuses, Mastodon doesn't check that the response from the remote server has a `Content-Type` header value of the Activity Streams media type, which allows a threat actor to upload a crafted Activity Streams document to a remote server and make a Mastodon server fetch it, if the remote server accepts arbitrary user uploads. The vulnerability allows a threat actor to impersonate an account on a remote server that satisfies all of the following properties: allows the attacker to register an account; accepts arbitrary user-uploaded documents and places them on the same domain as the ActivityPub actors; and serves user-uploaded document in response to requests with an `Accept` header value of the Activity Streams media type. Versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19 contain a fix for this issue.","status":"published","published":"2024-03-31T18:20:59.562Z","modified":"2026-09-08T08:48:13.164381033Z","updated_at":"2026-11-02T15:28:32.645004Z"}]}}