CVE-2024-52590: Missing validation allows spoofed profiles in Misskey
Misskey is an open source, federated social media platform. In affected versions missing validation in ApRequestService.signedGet allows an attacker to create fake user profiles that appear to be from a different instance than the one where they actually exist. These profiles can be used to impersonate existing users from the target instance. Vulnerable Misskey instances will accept spoofed users as valid, allowing an attacker to impersonate users on another instance. Attackers have full control of the spoofed user and can post, renote, or otherwise interact like a real account. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52590?
CVE-2024-52590 has a medium severity rating due to the potential for creating misleading user profiles.
How do I fix CVE-2024-52590?
To fix CVE-2024-52590, you should update Misskey to a patched version beyond 2024.11.0-alpha.3.
What versions of Misskey are affected by CVE-2024-52590?
CVE-2024-52590 affects all versions of Misskey up to but not including 2024.11.0-alpha.3.
What type of attack does CVE-2024-52590 enable?
CVE-2024-52590 enables attackers to create fake user profiles that can mislead users about their origins.
What component of Misskey is vulnerable in CVE-2024-52590?
The vulnerability in CVE-2024-52590 resides in the ApRequestService.signedGet method.