Lukas MartiniApr 11, 2017

I just went around and did some basic nmap-ing on the most popular Mastodon instances, and there's some seriously sketchy stuff in there. Publicly reachable Postgres servers, tons of open internal HTTP ports, SSH with password login, multiple Mastodon instances that seem to be running on mail server VMs, …

I guess if you're just running a single-user instance for yourself, sure, but those are all 2000+ user instances.

Show threadRenn KaneApr 11, 2017
@lutoma On an instance, I was actually able to login on ssh with the mastodon user using the password "mastodon". Wondering how many instances share the same issue.
Show threadbadosu ✅Apr 11, 2017
@dolfsquare @lutoma Please report this to the concerning admin, as this information is enough for a determined enough malicious agent to use the same exploit!
Show threadRenn KaneApr 11, 2017
@badosu @lutoma I obviously did it, and he fixed it
Show threadbadosu ✅
@dolfsquare @lutoma Thanks!
Apr 11, 2017 at 8:36pmWeb