PT-2024-33487 · Misskey · Misskey
Eternal-Flame-Ad
·
Published
2024-12-18
·
Updated
2024-12-19
·
CVE-2024-49363
CVSS v3.1
7.4
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Misskey versions 2024.10.1 or earlier
Description
Misskey is an open source, federated social media platform. In affected versions, the FileServerService (media proxy) did not detect proxy loops, allowing remote actors to execute a self-propagating reflected/amplified distributed denial-of-service via a maliciously crafted note. The
FileServerService.prototype.proxyHandler did not check if incoming requests were coming from another proxy server. An attacker can execute an amplified denial-of-service by sending a nested proxy request to the server and ending the request with a malicious redirect back to another nested proxy request, leading to unbounded recursion until the original request times out.Recommendations
For Misskey versions 2024.10.1 or earlier, upgrade to version 2024.11.0-alpha.3 or later.
As a temporary workaround for users unable to upgrade, configure the reverse proxy to block requests to the proxy with an empty
User-Agent header or one containing Misskey/.
Restrict access to the FileServerService.prototype.proxyHandler function to minimize the risk of exploitation.Exploit
Fix
Uncontrolled Recursion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Misskey