CVE-2023-36461
📋 TL;DR
This vulnerability in Mastodon allows malicious servers to perform slowloris-type attacks by extending HTTP response durations indefinitely. This can exhaust all Mastodon workers, making the server unresponsive. All Mastodon instances performing outgoing HTTP queries are affected.
💻 Affected Systems
- Mastodon
📦 What is this software?
Mastodon by Joinmastodon
Mastodon by Joinmastodon
Mastodon by Joinmastodon
⚠️ Risk & Real-World Impact
Worst Case
Complete service denial where all Mastodon workers are kept busy indefinitely, rendering the instance completely unresponsive to legitimate users.
Likely Case
Degraded performance and intermittent unavailability as workers are tied up by malicious slow responses.
If Mitigated
Minimal impact with proper timeouts and worker monitoring in place.
🎯 Exploit Status
Exploitation requires controlling a server that Mastodon queries, making it accessible to anyone who can set up a malicious server.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.9, 4.0.5, or 4.1.3
Vendor Advisory: https://github.com/mastodon/mastodon/security/advisories
Restart Required: Yes
Instructions:
1. Backup your Mastodon instance. 2. Update to version 3.5.9, 4.0.5, or 4.1.3 using your package manager or from source. 3. Restart Mastodon services. 4. Verify the update was successful.
🔧 Temporary Workarounds
Rate limit outgoing HTTP requests
allImplement rate limiting on outgoing HTTP queries to reduce impact of slowloris attacks
Configure in Mastodon's environment variables or reverse proxy settings
Monitor worker processes
linuxSet up monitoring for worker process health and implement automatic restarts
Use systemd or process manager to monitor and restart stuck workers
🧯 If You Can't Patch
- Implement network-level protections like WAF with slowloris detection
- Isolate Mastodon instance and restrict outgoing HTTP connections to trusted servers only
🔍 How to Verify
Check if Vulnerable:
Check Mastodon version against affected versions: prior to 3.5.9, 4.0.5, and 4.1.3Check Version:
RAILS_ENV=production bundle exec rails --versionVerify Fix Applied:
Confirm version is 3.5.9, 4.0.5, or 4.1.3 or later📡 Detection & Monitoring
Log Indicators:
- Long-duration HTTP requests in logs
- Worker process timeouts
- Increased error rates for outgoing requests
Network Indicators:
- Unusually slow HTTP responses from external servers
- High number of concurrent connections to single external host
SIEM Query:
source="mastodon.logs" AND (http_duration > 30s OR error="timeout")🔗 References
- http://www.openwall.com/lists/oss-security/2023/07/06/7
- https://github.com/mastodon/mastodon/commit/c5929798bf7e56cc2c79b15bed0c4692ded3dcb6
- https://github.com/mastodon/mastodon/releases/tag/v3.5.9
- https://github.com/mastodon/mastodon/releases/tag/v4.0.5
- https://github.com/mastodon/mastodon/releases/tag/v4.1.3
- https://github.com/mastodon/mastodon/security/advisories/GHSA-9pxv-6qvf-pjwc
- http://www.openwall.com/lists/oss-security/2023/07/06/7
- https://github.com/mastodon/mastodon/commit/c5929798bf7e56cc2c79b15bed0c4692ded3dcb6
- https://github.com/mastodon/mastodon/releases/tag/v3.5.9
- https://github.com/mastodon/mastodon/releases/tag/v4.0.5
- https://github.com/mastodon/mastodon/releases/tag/v4.1.3
- https://github.com/mastodon/mastodon/security/advisories/GHSA-9pxv-6qvf-pjwc
