CVE-2023-42450

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specific input, attackers can inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused deputy attacks if the server configuration includes `ALLOWED_PRIVATE_ADDRESSES` to allow access to local exploitable services. Version 4.2.0-rc2 has a patch for the issue.

• CWE-113
• CWE-918

• https://github.com/mastodon/mastodon/commit/94893cf24fc95b32cc7a756262acbe008c20a9d2Patch
• https://github.com/mastodon/mastodon/security/advisories/GHSA-hcqf-fw2r-52g4Vendor Advisory
• https://github.com/mastodon/mastodon/commit/94893cf24fc95b32cc7a756262acbe008c20a9d2Patch
• https://github.com/mastodon/mastodon/security/advisories/GHSA-hcqf-fw2r-52g4Vendor Advisory

Published

Sep 19, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-42445Gradle is a build tool with a focus on build automation and …5.3
• CVE-2023-42446Pow is a authentication and user management solution for Pho…6.5
• CVE-2023-42447blurhash-rs is a pure Rust implementation of Blurhash, softw…7.5
• CVE-2023-42448Hydra is the layer-two scalability solution for Cardano. Pri…8.1
• CVE-2023-42449Hydra is the two-layer scalability solution for Cardano. Pri…8.1
• CVE-2023-4245The WooCommerce PDF Invoice Builder for WordPress is vulnera…4.3
• CVE-2023-42451Mastodon is a free, open-source social network server based …7.5
• CVE-2023-42452Mastodon is a free, open-source social network server based …5.4
• CVE-2023-42453Synapse is an open-source Matrix homeserver written and main…4.3
• CVE-2023-42454SQLpage is a SQL-only webapp builder. Someone using SQLpage …9.1
• CVE-2023-42455Wazuh is a security detection, visibility, and compliance op…8.8
• CVE-2023-42456Sudo-rs, a memory safe implementation of sudo and su, allows…8.1