CVE-2024-25636

{"id": "CVE-2024-25636", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "published": "2024-02-19T20:15:46.077", "references": [{"url": "https://github.com/misskey-dev/misskey/blob/2024.2.0-beta.10/packages/backend/src/core/activitypub/ApResolverService.ts#L69-L119", "source": "security-advisories@github.com"}, {"url": "https://github.com/misskey-dev/misskey/blob/2024.2.0-beta.10/packages/backend/src/core/activitypub/models/ApNoteService.ts#L112-L308", "source": "security-advisories@github.com"}, {"url": "https://github.com/misskey-dev/misskey/blob/2024.2.0-beta.10/packages/backend/src/server/api/endpoints/ap/show.ts#L125-L143", "source": "security-advisories@github.com"}, {"url": "https://github.com/misskey-dev/misskey/commit/9a70ce8f5ea9df00001894809f5ce7bc69b14c8a", "source": "security-advisories@github.com"}, {"url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-qqrm-9grj-6v32", "source": "security-advisories@github.com"}, {"url": "https://github.com/misskey-dev/misskey/blob/2024.2.0-beta.10/packages/backend/src/core/activitypub/ApResolverService.ts#L69-L119", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/misskey-dev/misskey/blob/2024.2.0-beta.10/packages/backend/src/core/activitypub/models/ApNoteService.ts#L112-L308", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/misskey-dev/misskey/blob/2024.2.0-beta.10/packages/backend/src/server/api/endpoints/ap/show.ts#L125-L143", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/misskey-dev/misskey/commit/9a70ce8f5ea9df00001894809f5ce7bc69b14c8a", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-qqrm-9grj-6v32", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "Misskey is an open source, decentralized social media platform with ActivityPub support. Prior to version 2024.2.0, when fetching remote Activity Streams objects, Misskey doesn't check that the response from the remote server has a `Content-Type` header value of the Activity Streams media type, which allows a threat actor to upload a crafted Activity Streams document to a remote server and make a Misskey instance fetch it, if the remote server accepts arbitrary user uploads. The vulnerability allows a threat actor to impersonate and take over an account on a remote server that satisfies all of the following properties: allows the threat actor to register an account; accepts arbitrary user-uploaded documents and places them on the same domain as legitimate Activity Streams actors; and serves user-uploaded document in response to requests with an `Accept` header value of the Activity Streams media type. Version 2024.2.0 contains a patch for the issue."}, {"lang": "es", "value": "Misskey es una plataforma de redes sociales descentralizada y de c\u00f3digo abierto con soporte ActivityPub. Antes de la versi\u00f3n 2024.2.0, al recuperar objetos remotos de Activity Streams, Misskey no verifica que la respuesta del servidor remoto tenga un valor de encabezado `Content-Type` del tipo de medio Activity Streams, lo que permite a un actor de amenazas cargar un documento de Activity Streams elaborado a un servidor remoto y hacer que una instancia de Misskey lo recupere, si el servidor remoto acepta cargas arbitrarias de usuarios. La vulnerabilidad permite que un actor de amenazas se haga pasar por una cuenta y se haga cargo de ella en un servidor remoto que cumple con todas las siguientes propiedades: permite al actor de amenazas registrar una cuenta; acepta documentos arbitrarios subidos por usuarios y los coloca en el mismo dominio que los actores leg\u00edtimos de Activity Streams; y proporciona documentos subidos por el usuario en respuesta a solicitudes con un valor de encabezado \"Aceptar\" del tipo de medio Activity Streams. La versi\u00f3n 2024.2.0 contiene un parche para el problema."}], "lastModified": "2024-11-21T09:01:07.693", "sourceIdentifier": "security-advisories@github.com"}