PT-2023-31912 · Nexkey · Nexkey

Published 2023-12-27 · Updated 2024-01-04 · CVE-2023-52077

Positive Technologies (AI Summary)

CVSS v3.1

8.9

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Nexkey versions prior to 12.23Q4.5

Description Nexkey, a lightweight fork of Misskey v12 optimized for small to medium size servers, allows external apps using tokens issued by administrators and moderators to call admin APIs. This enables malicious third-party apps to perform operations such as updating server settings and compromise object storage and email server credentials.

Recommendations For versions prior to 12.23Q4.5, update to version 12.23Q4.5 to resolve the issue. As a temporary workaround, consider restricting the use of tokens issued by administrators and moderators to minimize the risk of exploitation. Restrict access to admin APIs to prevent malicious third-party apps from performing unauthorized operations.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2023-52077

GHSA-PJJ7-7HCJ-9CPC

Affected Products

Nexkey

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52077.json · Exploit
• https://github.com/misskey-dev/misskey/commit/5150053275594278e9eb23e72d98b16593c4c230 · Patch
• https://github.com/nexryai/nexkey/commit/a4e4c9c47c5f84ec7ccd309bde59d4ae5d7e5a98 · Patch
• https://github.com/nexryai/nexkey/security/advisories/GHSA-pjj7-7hcj-9cpc · Vendor Advisory
• https://github.com/mei23/misskey-v12/commit/78173e376f14fcc1987b02196f5538bf5b18225c · Patch
• https://osv.dev/vulnerability/CVE-2023-52077 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-52077 · Security Note
• https://twitter.com/VulmonFeeds/status/1740124289586598336 · Twitter Post
• https://t.me/cvenotify/66275 · Telegram Post
• https://twitter.com/CVEnew/status/1740083183436075333 · Twitter Post