If you use BotKit, update to a patched release now. This update addresses two vulnerabilities: GHSA-4qhx-hhwf-8685, an inbox origin validation flaw that could let an attacker supply forged objects or suppress genuine activities, and GHSA-8863-8468-7hq7, a key ownership validation flaw that could authenticate activities as the wrong actor under specific actor-document configurations. Both flaws originate in Fedify, which BotKit uses for federation.

GHSA-4qhx-hhwf-8685 affects incoming activities. Fedify authenticated the activity's actor but did not require the activity's id to share that actor's origin. An attacker needed only an actor and its signing key on a server they controlled, with no account on the receiving server or interaction from the victim.

By choosing an activity ID on another server's origin, the attacker could make Create.getObject() and other accessors return embedded objects claiming to live on that server without fetching them from it. BotKit checks that a message's attribution matches the activity's actor, but that does not stop an attacker from attributing an object to themselves while giving it an ID on another server. Its handlers could therefore receive forged objects under that server's object IDs. The same flaw also let an attacker who knew or could predict a genuine activity's ID reserve its idempotency cache entry by sending a forged activity with that ID first. The genuine delivery then received 202 Accepted but did not reach the inbox listeners for one day. With a message queue, this suppression applied across all inboxes on the receiving server.

The fix rejects non-portable activities whose IDs have a different origin from their actors before they reach inbox listeners, the queue, or the idempotency cache. The same origin check runs when processing activities from the queue or routing them manually.

GHSA-8863-8468-7hq7 affects Fedify's checks that a signing key belongs to an actor. Fedify fetched the actor's document and checked that it listed the key, but did not require the document's id to match the actor ID it requested. An attacker could have activities authenticated as a victim if dereferencing the victim's exact actor ID led to an actor document whose key the attacker controlled. This could happen through a redirect or alternate-document link, including to another origin, or when the victim's server directly served another same-origin actor's document.

The attacker cannot normally arrange this condition: it depends on the server hosting the victim's actor ID. A redirect from some other URL on that server is not enough. HTTP Signatures, Linked Data Signatures, and Object Integrity Proofs use the affected ownership checks.

The fix requires the fetched actor document's id to exactly match the requested actor ID. Fedify also retains its check that the document's id shares the origin of the final fetched URL. An actor whose ID redirects to a document with a different id can no longer have its keys confirmed through that redirect, even on the same origin and for the same account. Fedify's built-in key cache automatically ignores entries created under the weaker check and fetches and verifies those keys again. If your application separately supplies a custom KeyCache implementation to Fedify, clear it once when upgrading so previously cached false ownership claims are not retained.

BotKit 0.4.x versions through 0.4.9 and BotKit 0.5.x versions through 0.5.6 include Fedify versions affected by both vulnerabilities. The first patched releases, and the current recommended releases, are BotKit 0.4.10 and 0.5.7. BotKit 0.4.10 requires Fedify ~2.1.30, and BotKit 0.5.7 requires Fedify ~2.3.14. These are the two supported BotKit lines; users on older lines should move to a supported release.

For BotKit 0.5.x, install @fedify/botkit 0.5.7 using the command for your package manager:

npm install @fedify/botkit@0.5.7
yarn add @fedify/botkit@0.5.7
pnpm add @fedify/botkit@0.5.7
bun add @fedify/botkit@0.5.7
deno add jsr:@fedify/botkit@0.5.7

For BotKit 0.4.x, install @fedify/botkit 0.4.10:

npm install @fedify/botkit@0.4.10
yarn add @fedify/botkit@0.4.10
pnpm add @fedify/botkit@0.4.10
bun add @fedify/botkit@0.4.10
deno add jsr:@fedify/botkit@0.4.10

Check the installed or locked versions: @fedify/botkit should be 0.4.10 or 0.5.7, with @fedify/fedify at least 2.1.30 on the 2.1.x line or 2.3.14 on the 2.3.x line. If you use a routine update command instead, check that your declared dependency range allows the patched release and change it explicitly if needed. After updating, redeploy.

The full GitHub Security Advisories are GHSA-4qhx-hhwf-8685 and GHSA-8863-8468-7hq7. See also Fedify's own announcement.

Thanks to @2chanhaeng for reporting the inbox origin validation flaw to the Fedify project. The actor document identity mismatch was found by the Fedify maintainers with AI assistance.

If anything is unclear, feel free to ask on GitHub Discussions or Matrix.

自动翻译 · 阅读原文

如果您正在使用 BotKit，请立即更新到已修复漏洞的版本。本次更新解决了两个漏洞：GHSA-4qhx-hhwf-8685，该收件箱源验证（inbox origin validation）缺陷可能允许攻击者提供伪造对象或压制真实活动；以及 GHSA-8863-8468-7hq7，该密钥所有权验证缺陷可能导致在特定 actor 文档配置下，将活动错误地认证为其他 actor。这两个漏洞均源于 BotKit 用于实现联邦（federation）的底层框架 Fedify。

GHSA-4qhx-hhwf-8685 会影响入站活动。Fedify 会对活动的 actor 进行身份验证，但此前并未要求活动的 id 必须与该 actor 属于同一源（origin）。攻击者只需在其控制的服务器上拥有一个 actor 及其签名密钥即可发起攻击，无需在接收服务器上拥有账户，也无需受害者的任何交互。

通过将活动 ID 设置为另一台服务器的源，攻击者可以让 Create.getObject() 和其他访问器返回声称归属于该服务器的内嵌对象，而无需从该服务器获取这些对象。虽然 BotKit 会检查消息的归属（attribution）是否与活动的 actor 匹配，但这并不能阻止攻击者将对象归属于自己，同时为其分配另一台服务器上的 ID。因此，其处理器可能会接收到挂在目标服务器对象 ID 下的伪造对象。该缺陷还允许知晓或能够预测真实活动 ID 的攻击者，通过抢先发送包含该 ID 的伪造活动来预占其幂等性缓存条目。随后到达的真实投递虽然会收到 202 Accepted，但在一天内都不会传递给收件箱监听器。在使用消息队列的情况下，这种压制效果会作用于接收服务器上的所有收件箱。

修复方案在非便携活动（non-portable activities）的 ID 与其 actor 的源不一致时，在其到达收件箱监听器、队列或幂等性缓存之前直接予以拒绝。从队列处理活动或手动路由活动时，也会执行相同的源检查。

GHSA-8863-8468-7hq7 会影响 Fedify 针对签名密钥是否归属于 actor 的校验逻辑。Fedify 此前会获取 actor 的文档并检查其中是否列出了该密钥，但并未要求文档中的 id 与其请求的 actor ID 匹配。如果对受害者确切的 actor ID 进行解引用（dereference）后，重定向或链接到了攻击者控制其密钥的 actor 文档，攻击者就可以使活动被认证为受害者发起的。这种情况可能通过重定向或替代文档链接发生（包括指向其他源），或者受害者的服务器直接提供了另一个同源 actor 的文档。

攻击者通常无法自行构造这种条件：这取决于托管受害者 actor ID 的服务器。仅从该服务器上的其他某个 URL 进行重定向是不够的。HTTP 签名（HTTP Signatures）、关联数据签名（Linked Data Signatures）和对象完整性证明（Object Integrity Proofs）均使用了受影响的所有权检查机制。

修复方案要求获取到的 actor 文档的 id 必须与请求的 actor ID 完全匹配。Fedify 还保留了文档 id 必须与最终获取的 URL 同源的检查。如果某个 actor 的 ID 重定向到了包含不同 id 的文档，则无法再通过该重定向确认其密钥，即使处于同一源且属于同一账户也是如此。Fedify 内置的密钥缓存会自动忽略在较弱检查机制下创建的条目，并重新获取和验证这些密钥。如果您的应用程序单独向 Fedify 提供了自定义的 KeyCache 实现，请在升级时清理一次缓存，以避免保留此前缓存的错误所有权声明。

BotKit 0.4.x（最高至 0.4.9）以及 BotKit 0.5.x（最高至 0.5.6）包含受这两个漏洞影响的 Fedify 版本。首批修复版本以及当前推荐的版本为 BotKit 0.4.10 和 0.5.7。BotKit 0.4.10 要求 Fedify ~2.1.30，BotKit 0.5.7 要求 Fedify ~2.3.14。这两个版本是目前受支持的 BotKit 分支；使用更早分支的用户应升级到受支持的版本。

针对 BotKit 0.5.x，请使用对应包管理器的命令安装 @fedify/botkit 0.5.7：

npm install @fedify/botkit@0.5.7
yarn add @fedify/botkit@0.5.7
pnpm add @fedify/botkit@0.5.7
bun add @fedify/botkit@0.5.7
deno add jsr:@fedify/botkit@0.5.7

针对 BotKit 0.4.x，请安装 @fedify/botkit 0.4.10：

npm install @fedify/botkit@0.4.10
yarn add @fedify/botkit@0.4.10
pnpm add @fedify/botkit@0.4.10
bun add @fedify/botkit@0.4.10
deno add jsr:@fedify/botkit@0.4.10

请检查已安装或锁定的版本：@fedify/botkit 应为 0.4.10 或 0.5.7，且对于 2.1.x 分支，@fedify/fedify 应至少为 2.1.30；对于 2.3.x 分支，应至少为 2.3.14。如果您使用的是常规更新命令，请确保声明的依赖版本范围允许安装修复版本，并在必要时显式更改。更新完成后，请重新部署。

完整的 GitHub 安全通告请见 GHSA-4qhx-hhwf-8685 与 GHSA-8863-8468-7hq7。另请参阅 Fedify 官方公告。

感谢 @2chanhaeng 向 Fedify 项目报告收件箱源验证缺陷。actor 文档标识不匹配问题由 Fedify 维护人员在 AI 的协助下发现。

如有任何疑问，欢迎在 GitHub Discussions 或 Matrix 上进行交流。