Executive Summary

This vulnerability affects Mastodon versions from 4.3.0 until 4.5.11 and 4.4.18. Mastodon has a feature that allows websites to credit authors of their articles using the attributionDomains JSON-LD term to prevent false attribution claims. However, there is an error in how this term is defined, which makes Linked Data Signatures on the toot:attributionDomains property ineffective.

Because of this flaw, an attacker can arbitrarily modify the attributionDomains value of a legitimately signed Update activity and bypass Mastodon's signature verification.

This means that the attacker can forge or alter attribution information despite the presence of signature verification, undermining the integrity of author attribution.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to modify the attributionDomains value on a legitimately signed update, effectively bypassing signature verification.

As a result, false attribution claims can be made, which can lead to misinformation about the authorship of content.

This could damage trust in the authenticity of content shared on Mastodon instances and potentially harm reputations or mislead users.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Mastodon to version 4.5.11 or 4.4.18 or later, where the issue with the attributionDomains JSON-LD term and signature verification has been fixed.

Useful 0 Not Useful 0