CVE-2024-25619

{"id": "CVE-2024-25619", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.6}]}, "published": "2024-02-14T21:15:08.620", "references": [{"url": "https://github.com/mastodon/mastodon/commit/68eaa804c9bafdc5f798e114e9ba00161425dd71", "source": "security-advisories@github.com"}, {"url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-7w3c-p9j8-mq3x", "source": "security-advisories@github.com"}, {"url": "https://github.com/mastodon/mastodon/commit/68eaa804c9bafdc5f798e114e9ba00161425dd71", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-7w3c-p9j8-mq3x", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-613"}, {"lang": "en", "value": "CWE-672"}]}], "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. When an OAuth Application is destroyed, the streaming server wasn't being informed that the Access Tokens had also been destroyed, this could have posed security risks to users by allowing an application to continue listening to streaming after the application had been destroyed. Essentially this comes down to the fact that when Doorkeeper sets up the relationship between Applications and Access Tokens, it uses a `dependent: delete_all` configuration, which means the `after_commit` callback setup on `AccessTokenExtension` didn't actually fire, since `delete_all` doesn't trigger ActiveRecord callbacks. To mitigate, we need to add a `before_destroy` callback to `ApplicationExtension` which announces to streaming that all the Application's Access Tokens are being \"killed\". Impact should be negligible given the affected application had to be owned by the user. None the less this issue has been addressed in versions 4.2.6, 4.1.14, 4.0.14, and 3.5.18. Users are advised to upgrade. There are no known workaround for this vulnerability."}, {"lang": "es", "value": "Mastodon es un servidor de red social gratuito y de c\u00f3digo abierto basado en ActivityPub. Cuando se destruye una aplicaci\u00f3n OAuth, no se informaba al servidor de transmisi\u00f3n que los tokens de acceso tambi\u00e9n se hab\u00edan destruido, lo que podr\u00eda haber planteado riesgos de seguridad para los usuarios al permitir que una aplicaci\u00f3n continuara escuchando la transmisi\u00f3n despu\u00e9s de que la aplicaci\u00f3n hubiera sido destruida. Esencialmente, esto se reduce al hecho de que cuando Doorkeeper configura la relaci\u00f3n entre las aplicaciones y los tokens de acceso, utiliza una configuraci\u00f3n `dependent: delete_all`, lo que significa que la configuraci\u00f3n de devoluci\u00f3n de llamada `after_commit` en `AccessTokenExtension` en realidad no se activ\u00f3, ya que ` delete_all` no activa devoluciones de llamada de ActiveRecord. Para mitigar, necesitamos agregar una devoluci\u00f3n de llamada `before_destroy` a `ApplicationExtension` que anuncia a la transmisi\u00f3n que todos los tokens de acceso de la aplicaci\u00f3n est\u00e1n siendo \"eliminados\". El impacto deber\u00eda ser insignificante dado que la aplicaci\u00f3n afectada ten\u00eda que ser propiedad del usuario. No obstante, este problema se ha solucionado en las versiones 4.2.6, 4.1.14, 4.0.14 y 3.5.18. Se recomienda a los usuarios que actualicen. No se conocen workaround para esta vulnerabilidad."}], "lastModified": "2024-11-21T09:01:05.790", "sourceIdentifier": "security-advisories@github.com"}