PT-2021-22450 · Misskey · Misskey

Acid-Chicken + 2 · Published 2021-09-07 · Updated 2021-09-14 · CVE-2021-39195

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Misskey versions prior to 12.90.0

Description A Server-Side Request Forgery issue exists in the "Upload from URL" and remote attachment handling features of Misskey, potentially leading to the disclosure of non-public information within the internal network. This issue can be mitigated by restricting access to private networks from the host where the application is running.

Recommendations For versions prior to 12.90.0, update to version 12.90.0 to resolve the issue. If a proxy is in use, additional measures will be necessary. As a temporary workaround, consider restricting access to private networks from the host where the application is running to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2021-39195

GHSA-MQV7-GXH4-R5VF

Affected Products

Misskey

References · 6

• https://github.com/misskey-dev/misskey/security/advisories/GHSA-mqv7-gxh4-r5vf · Patch
• https://github.com/misskey-dev/misskey/commit/e1a8b158e04ad567d92d8daf3cc0898ee18f1a2e · Patch
• https://osv.dev/vulnerability/CVE-2021-39195 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39195 · Security Note
• https://github.com/misskey-dev/misskey/blob/develop/CHANGELOG.md#12900-20210904 · Note
• https://t.me/cibsecurity/28379 · Telegram Post