PT-2023-31930 · Misskey · Misskey
Chocolate-Pie
·
Published
2023-12-29
·
Updated
2024-01-05
·
CVE-2023-52139
CVSS v3.1
9.0
Critical
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Misskey versions prior to 2023.12.1
Description
Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified without the user's permission and perform operations such as reading or adding non-public content. If the user who authenticated the application is an administrator, confidential information such as object storage secret keys and SMTP server passwords will be leaked, and general users can also create invitation codes without permission and leak non-public user information. Approximately 2,133 instances are mainly distributed in Japan, the United States, and other countries.
Recommendations
For versions prior to 2023.12.1, update to version 2023.12.1 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable endpoints and Websocket APIs until the update is applied. Avoid using third-party applications that may exploit this issue until they are updated to work with the patched version of Misskey.
Exploit
Fix
Improper Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Misskey