CVE-2024-52591: Missing validation allows spoofed profiles and notes in Misskey
Misskey is an open source, federated social media platform. In affected versions missing validation in ApRequestService.signedGet and HttpRequestService.getActivityJson allows an attacker to create fake user profiles and forged notes. The spoofed users will appear to be from a different instance than the one where they actually exist, and the forged notes will appear to be posted by a different user. Vulnerable Misskey instances will accept the spoofed objects as valid, allowing an attacker to impersonate other users and instances. The attacker retains full control of the spoofed user / note and can interact like a real account. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52591?
CVE-2024-52591 has been classified as a moderate severity vulnerability due to its potential for misuse in creating spoofed user profiles.
How do I fix CVE-2024-52591?
To fix CVE-2024-52591, upgrade your Misskey instance to version 2024.11.0-alpha.3 or later.
What versions of Misskey are affected by CVE-2024-52591?
Misskey versions prior to 2024.11.0-alpha.3 are affected by CVE-2024-52591.
What are the implications of CVE-2024-52591?
CVE-2024-52591 allows attackers to create fake user profiles and forge notes, potentially misleading users and disrupting the platform.
Is there a workaround for CVE-2024-52591?
There is no reported workaround for CVE-2024-52591; updating to a patched version is recommended.