Post · Fedizen

@silverpill@mitra.social 4 hr. ago

https://github.com/mastodon/mastodon/security/advisories/GHSA-288h-6j8h-6x5j

It's been two weeks, and they still haven't published the details.

What does "identifier verification" even mean?

Insufficient ActivityPub identifier verification

### Summary A flaw in how ActivityPub identifiers are authenticated allows for attackers to impersonate remote actors. ### Impact Attackers can craft posts and quote/collection approval st...

0 Boosts

0 Likes

@phnt@fluffytail.org 3 hr. ago

@silverpill Probably something fun like the subdomain account spoof from couple years ago.

@silverpill@mitra.social 3 hr. ago

Maybe "identifier verification" is when you fetch an object by its id. That was a big one, also ranked as "Critical":

https://github.com/mastodon/mastodon/security/advisories/GHSA-3fjr-858r-92rw

Remote user impersonation and takeover

### Summary Due to a gap in validation of federated content in the affected Mastodon versions, attackers can craft payloads that impersonate remote ActivityPub actors (federated accounts) as-see...