PT-2024-35389 · Misskey · Misskey

Warriordog · Published 2024-12-18 · Updated 2025-11-26 · CVE-2024-52592

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Misskey versions prior to 2024.11.0-alpha.3

Description Misskey is an open source, federated social media platform. In affected versions, missing validation in ApInboxService.update allows an attacker to modify the result of polls belonging to another user. No authentication is required, except for a valid signature from any actor on any remote instance. Vulnerable Misskey instances will accept spoofed updates for remote polls. Local polls are unaffected.

Recommendations For versions prior to 2024.11.0-alpha.3, update to version 2024.11.0-alpha.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the ApInboxService.update function until a patch is available. Avoid accepting updates for remote polls from untrusted sources until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-52592

GHSA-5H8R-GQ97-XV69

Affected Products

Misskey

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52592.json · Exploit
• https://github.com/misskey-dev/misskey/security/advisories/GHSA-5h8r-gq97-xv69 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52592 · Security Note
• https://osv.dev/vulnerability/CVE-2024-52592 · Vendor Advisory
• https://t.me/cveNotify/144109 · Telegram Post
• https://t.me/cvedetector/13247 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1869560416528932870 · Twitter Post
• https://twitter.com/CVEnew/status/1869466914222674071 · Twitter Post