BotKit security updates: 0.4.10 and 0.5.7

[dahlia]

If you use BotKit, update to a patched release now. This update addresses two vulnerabilities: GHSA-4qhx-hhwf-8685, an inbox origin validation flaw that could let an attacker supply forged objects or suppress genuine activities, and GHSA-8863-8468-7hq7, a key ownership validation flaw that could authenticate activities as the wrong actor under specific actor-document configurations. Both flaws originate in Fedify, which BotKit uses for federation.

GHSA-4qhx-hhwf-8685 affects incoming activities. Fedify authenticated the activity's actor but did not require the activity's id to share that actor's origin. An attacker needed only an actor and its signing key on a server they controlled, with no account on the receiving server or interaction from the victim.

By choosing an activity ID on another server's origin, the attacker could make Create.getObject() and other accessors return embedded objects claiming to live on that server without fetching them from it. BotKit checks that a message's attribution matches the activity's actor, but that does not stop an attacker from attributing an object to themselves while giving it an ID on another server. Its handlers could therefore receive forged objects under that server's object IDs. The same flaw also let an attacker who knew or could predict a genuine activity's ID reserve its idempotency cache entry by sending a forged activity with that ID first. The genuine delivery then received 202 Accepted but did not reach the inbox listeners for one day. With a message queue, this suppression applied across all inboxes on the receiving server.

The fix rejects non-portable activities whose IDs have a different origin from their actors before they reach inbox listeners, the queue, or the idempotency cache. The same origin check runs when processing activities from the queue or routing them manually.

GHSA-8863-8468-7hq7 affects Fedify's checks that a signing key belongs to an actor. Fedify fetched the actor's document and checked that it listed the key, but did not require the document's id to match the actor ID it requested. An attacker could have activities authenticated as a victim if dereferencing the victim's exact actor ID led to an actor document whose key the attacker controlled. This could happen through a redirect or alternate-document link, including to another origin, or when the victim's server directly served another same-origin actor's document.

The attacker cannot normally arrange this condition: it depends on the server hosting the victim's actor ID. A redirect from some other URL on that server is not enough. HTTP Signatures, Linked Data Signatures, and Object Integrity Proofs use the affected ownership checks.

The fix requires the fetched actor document's id to exactly match the requested actor ID. Fedify also retains its check that the document's id shares the origin of the final fetched URL. An actor whose ID redirects to a document with a different id can no longer have its keys confirmed through that redirect, even on the same origin and for the same account. Fedify's built-in key cache automatically ignores entries created under the weaker check and fetches and verifies those keys again. If your application separately supplies a custom KeyCache implementation to Fedify, clear it once when upgrading so previously cached false ownership claims are not retained.

BotKit 0.4.x versions through 0.4.9 and BotKit 0.5.x versions through 0.5.6 include Fedify versions affected by both vulnerabilities. The first patched releases, and the current recommended releases, are BotKit 0.4.10 and 0.5.7. BotKit 0.4.10 requires Fedify ~2.1.30, and BotKit 0.5.7 requires Fedify ~2.3.14. These are the two supported BotKit lines; users on older lines should move to a supported release.

For BotKit 0.5.x, install @fedify/botkit 0.5.7 using the command for your package manager:

npm  install @fedify/botkit@0.5.7
yarn add     @fedify/botkit@0.5.7
pnpm add     @fedify/botkit@0.5.7
bun  add     @fedify/botkit@0.5.7
deno add     jsr:@fedify/botkit@0.5.7

For BotKit 0.4.x, install @fedify/botkit 0.4.10:

npm  install @fedify/botkit@0.4.10
yarn add     @fedify/botkit@0.4.10
pnpm add     @fedify/botkit@0.4.10
bun  add     @fedify/botkit@0.4.10
deno add     jsr:@fedify/botkit@0.4.10

Check the installed or locked versions: @fedify/botkit should be 0.4.10 or 0.5.7, with @fedify/fedify at least 2.1.30 on the 2.1.x line or 2.3.14 on the 2.3.x line. If you use a routine update command instead, check that your declared dependency range allows the patched release and change it explicitly if needed. After updating, redeploy.

The full GitHub Security Advisories are GHSA-4qhx-hhwf-8685 and GHSA-8863-8468-7hq7. See also Fedify's own announcement.

Thanks to @2chanhaeng for reporting the inbox origin validation flaw to the Fedify project. The actor document identity mismatch was found by the Fedify maintainers with AI assistance.

If anything is unclear, feel free to ask on GitHub Discussions or Matrix.