Threat Investigation
Request a demo

CVE-2024-52579

Medium

Description

Misskey is an open source, federated social media platform. Some APIs using `HttpRequestService` do not properly check the target host. This vulnerability allows an attacker to send POST or GET requests to the internal server, which may result in a SSRF attack.It allows an attacker to send POST or GET requests (with some controllable URL parameters) to private IPs, enabling further attacks on internal servers. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

SeverityMedium
CVSS6.4
Exploit probability—
ProductMisskey
PublishedDec 18, 2024
First seenDec 18, 2024
Weakness typeCWE-918Server-side request forgery (SSRF)CWE-20Improper input validation

How to fix

Update
  • misskey misskey2024.11.0 or later

Affected products

ProductAffected versionsFixed in
misskey misskeyv < 2024.11.0, 2024.11.02024.11.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.