CyberRota Analysis
AI-GeneratedMastodon versions prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1 are vulnerable to a denial-of-service attack due to improper authorization checks on administrative statistics endpoints, which can be exploited by anonymous users to initiate resource-intensive SQL queries. This can lead to server resource exhaustion, impacting availability. Administrators of affected Mastodon instances should prioritize upgrading to the patched versions to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused long-running SQL queries in Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension, allowing repeated requests to exhaust server resources. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.