CyberRota Analysis
AI-GeneratedMastodon versions prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1 are vulnerable to an issue where the PrivateAddressCheck mechanism fails to recognize IPv4-compatible IPv6 addresses, allowing attackers to bypass protections and send HTTP requests to loopback interfaces. This could lead to unauthorized access to private resources and services. Organizations using affected versions should prioritize upgrading to the patched releases to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.private_address? in app/lib/private_address_check.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with IPAddr#ipv4_compat?. An attacker could supply an address in the omitted range to bypass the ALLOWED_PRIVATE_ADDRESSES protection and make Mastodon send HTTP requests to loopback interfaces, potentially accessing private resources and services. Exploitation requires a system that supports the obsolete IPv4-compatible IPv6 mechanism. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.