CVE-2024-25108
📋 TL;DR
This CVE describes an authorization bypass vulnerability in Pixelfed that allows attackers to access administrative and moderator functionality beyond their intended permissions. It affects all Pixelfed versions between v0.10.4 and v0.11.9, inclusive, potentially impacting all local users and server federation capabilities. Some user interaction is required to set up attack conditions, but exploitation can occur in a time-delayed manner.
💻 Affected Systems
- Pixelfed
📦 What is this software?
Pixelfed by Pixelfed
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative control over the Pixelfed instance, allowing them to modify server settings, access all user data, disrupt federation, and potentially compromise the underlying server.
Likely Case
Attackers access moderator/admin functionality to view sensitive data, modify content, or disrupt normal operations of the Pixelfed instance.
If Mitigated
With proper network segmentation and monitoring, impact is limited to the Pixelfed application layer with no lateral movement to other systems.
🎯 Exploit Status
Proof of concept exists and some user interaction is required to set up conditions, but exploitation itself is straightforward once conditions are met.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.11.11
Vendor Advisory: https://github.com/pixelfed/pixelfed/security/advisories/GHSA-gccq-h3xj-jgvf
Restart Required: Yes
Instructions:
1. Backup your Pixelfed instance and database. 2. Update to Pixelfed v0.11.11 or later using your preferred update method (git pull, package manager, etc.). 3. Run any required database migrations. 4. Restart the Pixelfed service and web server.
🧯 If You Can't Patch
- Isolate the Pixelfed instance from other systems using network segmentation.
- Implement strict monitoring for unusual administrative activity and access patterns.
🔍 How to Verify
Check if Vulnerable:
Check your Pixelfed version. If it's between v0.10.4 and v0.11.9 inclusive, you are vulnerable.Check Version:
Check the Pixelfed admin panel or run: php artisan version (if using Laravel Artisan)Verify Fix Applied:
Verify your Pixelfed version is v0.11.11 or later and test that authorization checks are properly enforced for administrative functions.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to admin/mod endpoints
- User accounts accessing functionality beyond their role permissions
- Unusual administrative actions from non-admin accounts
Network Indicators:
- Requests to administrative endpoints from non-admin IPs
- Unusual API call patterns to privileged endpoints
SIEM Query:
source="pixelfed" AND (uri_path="/admin/*" OR uri_path="/mod/*") AND user_role!="admin"🔗 References
- https://github.com/pixelfed/pixelfed/commit/7e47d6dccb0393a2e95c42813c562c854882b037
- https://github.com/pixelfed/pixelfed/security/advisories/GHSA-gccq-h3xj-jgvf
- https://github.com/pixelfed/pixelfed/commit/7e47d6dccb0393a2e95c42813c562c854882b037
- https://github.com/pixelfed/pixelfed/security/advisories/GHSA-gccq-h3xj-jgvf
