Elevated Permissions Vulnerability in Pixelfed/pixelfed
Summary
CVE-2024-25108: Pixelfed doesn't check OAuth Scopes in API routes, giving elevated permissions. Affects pixelfed/pixelfed versions >= 0.10.4, < 0.11.11. Fixed in 0.11.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pixelfed is an open-source federated image sharing platform that allows users to share photos and interact with others. It provides features such as user profiles, timelines, and moderation tools. However, a vulnerability has been discovered in Pixelfed versions 0.10.4 to 0.11.9, which allows attackers to gain elevated permissions and access administrative and moderator functionality.
Vulnerability Detail
The vulnerability arises from improper and insufficient authorization checks in the processing of requests. This allows attackers to bypass intended restrictions and gain access to functionalities that should only be available to administrators and moderators. The impact of this vulnerability is significant as it affects all local users of a Pixelfed server and can potentially disrupt the server's ability to federate with other instances. Although some user interaction is required to set up the conditions for exploiting the vulnerability, an attacker can execute the attack in a time-delayed manner without active user involvement.
How To Fix
Minimum fixed version
0.11.11
This is the first release that contains the fix.
composer require pixelfed/pixelfed:0.11.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Pixelfed to the patched version as soon as possible.
Conclusion
The elevated permissions vulnerability in Pixelfed versions 0.10.4 to 0.11.9 allows attackers to gain unauthorized access to administrative and moderator functionality. To mitigate this vulnerability, it is essential to update Pixelfed to version 0.11.11 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pixelfed/pixelfed →
FAQ
Pixelfed is an open-source federated image sharing platform that allows users to share photos and interact with others. It provides features such as user profiles, timelines, and moderation tools.
The vulnerability affects Pixelfed versions 0.10.4 to 0.11.9, inclusive.
With elevated permissions, an attacker can access administrative and moderator functionality of the Pixelfed server. This includes performing actions that should only be available to authorized personnel, potentially compromising the server's security and user data.
While some user interaction is necessary to set up the conditions for exploiting the vulnerability, an attacker can execute the attack in a time-delayed manner without active user involvement.
To protect your Pixelfed server, it is crucial to update to version 0.11.11 or later. This update includes the necessary fixes to address the vulnerability and ensure proper authorization checks.
References
Related vulnerabilities
Recent vulnerabilities recorded for pixelfed/pixelfed.
