chaos

And here we go for the 2nd blog post about a vulnerability in Mastodon. It details how HTTP signatures can be bypassed because of an innocuous bug, and how it can lead to the spoofing of Mastodon instances depending on their domain name. Don't worry, infosec.exchange wasn't vulnerable ;)

https://scumjr.github.io/2023/11/07/usurping-mastodon-instances-cve-2023-42451/

@tanavit@toot.aquilenet.fr @MonniauxD@social.sciences.re "Command & Control": ce sont le ou les serveurs utilisés par les attaquants pour communiquer avec les systèmes compromis.