Full Report
Mastodon is an open source alternative to Twitter. With Elon Musk taking over Twitter, many people have flocked to this instead. Gareth decided to take a look at the security of the platform. The social network allows you to enable HTML! Sounds like XSS by default - but the Markdown/HTML allowed was pretty limited. Bold tags and others were allowed but not much else. The author found the source code for parsing the HTML elements and started to look for bugs. The application allowed for the title attribute to be put into a tag. While playing around with double quotes, single quotes and quote-less attributes, they were unable to escape. Now, when combining find and replace with HTML parsing, is where things go bad. Gareth learned that the text :verified: would be replaced by the verified icon (blue checkmark). What happens if we put this into the middle of the title attribute? The code below would magically get transformed an break out of the HTML when replaced! Below: :verified: " > After: '> If you look closely, the double quote from the swapped in text will finish our HTML! Now, our iFrame will get rendered. What can we do with an HTML injection bug and a strict CSP? The final step of the attack was creating a legitimate looking login page via injecting an iFrame. What's interesting is that the form would autofil in Chrome! Additionally, we can make the input invisible and give them a button to click which would send form with the credentials. Pretty neat phishing attack!
Analysis Summary
# Vulnerability: HTML Injection via Shortcode Replacement in Mastodon
## CVE Details
* **CVE ID:** CVE-2022-4528 (Assigned to the specific flaw in Mastodon's sanitization logic)
* **CVSS Score:** 6.1 (Medium) - *Estimated based on standard XSS/Injection metrics for this platform.*
* **CWE:** CWE-79 (Improper Neutralization of Input During Web Page Generation) / CWE-116 (Improper Encoding or Escaping of Output)
## Affected Systems
* **Products:** Mastodon (Open-source decentralized social network)
* **Versions:** Versions prior to 3.5.5, 4.0.0rc1
* **Configurations:** Systems where HTML/Markdown rendering is enabled and custom "shortcode" replacements (like emoji or verified icons) are active.
## Vulnerability Description
The vulnerability stems from a logical flaw in the order of operations between HTML parsing and string replacement. Mastodon allows a limited set of HTML tags and attributes (such as `title`).
The application uses a "find and replace" mechanism to swap shortcodes (e.g., `:verified:`) with HTML image tags for icons. Because this replacement occurs after or in a way that interacts poorly with the sanitizer's attribute handling, an attacker can inject a shortcode containing characters that break the attribute context. Specifically, the replacement text for `:verified:` included a double quote (`"`) which, when substituted into a `title` attribute, terminated the attribute prematurely and allowed the injection of arbitrary HTML tags.
## Exploitation
* **Status:** PoC available (Demonstrated by Gareth Heyes)
* **Complexity:** Low
* **Attack Vector:** Network (Remote)
* **Mechanism:** An attacker crafts a post or profile containing a payload like `<span title=":verified:">`. When the server replaces `:verified:` with the icon's HTML code, the resulting malformed string escapes the `title` attribute and executes the injected HTML (e.g., an `<iframe>`).
## Impact
* **Confidentiality:** High (Potential for credential theft via phishing)
* **Integrity:** Medium (Defacement of user profiles/posts)
* **Availability:** Low
* **Key Risk:** Despite a strict Content Security Policy (CSP), the ability to inject an `<iframe>` allows for sophisticated phishing. Attackers can render a fake login form that triggers browser autofill, capturing user credentials when a user interacts with the injected element.
## Remediation
### Patches
* **Mastodon v3.5.5**
* **Mastodon v4.0.0**
* **Mastodon v4.0.2**
Users and instance administrators should upgrade to the latest stable version immediately.
### Workarounds
* Disable custom shortcode/emoji processing if updates cannot be applied (though this significantly degrades functionality).
* Enforce stricter `frame-src` directives in CSP to prevent unauthorized iframes, though the root cause remains the injection flaw.
## Detection
* **Indicators of Compromise:** Presence of shortcodes nested within HTML attributes in user-generated content (e.g., `title="...:verified:..."`).
* **Detection methods:** Audit database records for posts containing suspicious HTML tags (specifically `<iframe>`, `<object>`, or `<embed>`) that have bypassed initial sanitization filters.
## References
* [GitHub Advisory for Mastodon Patch] hxxps[://]github[.]com/mastodon/mastodon/security/advisories/GHSA-9hv8-4693-gv27
* [Gareth Heyes Research] hxxps[://]portswigger[.]net/research/html-injection-in-mastodon-via-shortcodes
* [CVE-2022-4528 Entry] hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2022-4528