Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.4

Misskey APIs allow attackers to reach internal servers

CVE-2024-52579 · published 1 year ago
Summary

The Misskey social platform’s APIs can be tricked into sending requests to private network addresses, potentially exposing internal systems. This can let an attacker interact with services that should be hidden from the internet. Update Misskey to version 2024.11.0‑alpha.3 or later to close the issue.

What to do
  • Update misskey misskey to version 2024.11.0 or later.
Affected software
VendorProductAffected versions
misskey misskey < 2024.11.0
2024.11.0
cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:*
Original advisory text
Server-Side Request Forgery vulnerability in various APIs in Misskey
Misskey is an open source, federated social media platform. Some APIs using `HttpRequestService` do not properly check the target host. This vulnerability allows an attacker to send POST or GET requests to the internal server, which may result in a SSRF attack.It allows an attacker to send POST or GET requests (with some controllable URL parameters) to private IPs, enabling further attacks on internal servers. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published18 Dec 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-52579 · NVD
CVE-2024-52579 · OSV
GHSA-5q3h-wpfw-hjjw · GHSA
Track software like this
Free during beta