CVE-2024-52579CWE-20CWE-918

Server-Side Request Forgery vulnerability in various APIs in Misskey

Medium · published December 18, 2024

CVSS v3.1
6.4
EPSS
0%
Percentile
11.9
In the wild
Unconfirmed
What it is

Misskey is an open source, federated social media platform. Some APIs using `HttpRequestService` do not properly check the target host. This vulnerability allows an attacker to send POST or GET requests to the internal server, which may result in a SSRF attack.It allows an attacker to send POST or GET requests (with some controllable URL parameters) to private IPs, enabling further attacks on internal servers. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00221 · 11.9th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-918 · Server-Side Request Forgery (SSRF)
Published
2024-12-18T19:22Z
EPSS history
Timeline
  • 18 DEC 19:22Z
    Server-Side Request Forgery vulnerability in various APIs in Misskey
    cvelistv5