CVE-2024-52592 Missing validation allows spoofed poll updates in Misskey

Medium 6.9 Published 18 Dec 2024 Updated 18 Dec 2024

Attackers can spoof poll updates for remote users in Misskey due to missing validation, allowing unauthorized modification of poll results.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-52592?

CVE-2024-52592 is a medium-severity missing authorization vulnerability in misskey-dev misskey, published on 18 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Misskey is an open source, federated social media platform. In affected versions missing validation in `ApInboxService.update` allows an attacker to modify the result of polls belonging to another user. No authentication is required, except for a valid signature from any actor on any remote instance. Vulnerable Misskey instances will accept spoofed updates for remote polls. Local polls are unaffected. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-20

Which versions are affected by CVE-2024-52592?

It affects 1 product.

Products include Misskey Misskey.

How do I fix CVE-2024-52592?

No fix has been published for CVE-2024-52592 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-52592 being exploited?

There is no known exploitation of CVE-2024-52592 in the wild and no public exploit code.

Sources

Also known as GHSA-5h8r-gq97-xv69.