Mastodon is a free, open-source social network server based on ActivityPub. When an OAuth Application is destroyed, the streaming server wasnt being informed that the Access Tokens had also been destroyed, this could have posed security risks to users by allowing an application to continue listening to streaming after the application had been destroyed. Essentially this comes down to the fact that when Doorkeeper sets up the relationship between Applications and Access Tokens, it uses a dependent: delete_all configuration, which means the after_commit callback setup on AccessTokenExtension didnt actually fire, since delete_all doesnt trigger ActiveRecord callbacks. To mitigate, we need to add a before_destroy callback to ApplicationExtension which announces to streaming that all the Applications Access Tokens are being killed. Impact should be negligible given the affected application had to be owned by the user. None the less this issue has been addressed in versions 4.2.6, 4.1.14, 4.0.14, and 3.5.18. Users are advised to upgrade. There are no known workaround for this vulnerability.
According to WASC, “Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.”
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mastodon | Joinmastodon | * | 3.5.18 (excluding) |
| Mastodon | Joinmastodon | 4.0.0 (including) | 4.0.14 (excluding) |
| Mastodon | Joinmastodon | 4.1.0 (including) | 4.1.14 (excluding) |
| Mastodon | Joinmastodon | 4.2.0 (including) | 4.2.6 (excluding) |