Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-52593: Misskey lets attackers set fake external links

CVE-2024-52593 · published 1 year ago

Summary

In Misskey versions before the November 2024 update, the software does not check the URL used for "origin" links, so a malicious user can make those links point to any web address they choose. This can cause users to be directed to phishing sites or other harmful pages when they click on what appears to be a legitimate link. Upgrade Misskey to version 2024.11.0-alpha.3 or later to fix the problem; no other workaround is available.

What to do

Update misskey misskey to version 2024.11.0 or later.

Affected software

Vendor	Product	Affected versions
misskey	misskey	>= 12.29.0, < 2024.11.0 2024.11.0 `cpe:2.3:a:misskey:misskey::::::::`

Original advisory text

Missing validation allows spoofed "origin" links in Misskey

Misskey is an open source, federated social media platform.In affected versions missing validation in `NoteCreateService.insertNote`, `ApPersonService.createPerson`, and `ApPersonService.updatePerson` allows an attacker to control the target of any "origin" links (such as the "view on remote instance" banner). Any HTTPS URL can be set, even if it belongs to a different domain than the note / user. Vulnerable Misskey instances will use the unverified URL for several clickable links, allowing an attacker to conduct phishing or other attacks against remote users. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References

https://github.com/misskey-dev/misskey/security/advisories/GHSA-675w-hf2m-qwmj Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52593... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-52593 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-20Improper Input Validation

Timeline

Published18 Dec 2024

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-52593 · NVD

CVE-2024-52593 · OSV

GHSA-675w-hf2m-qwmj · GHSA

Track software like this

Free during beta