CVE-2024-52591

Estado: AnalizadaAlta (8.8)—

Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` and `HttpRequestService.getActivityJson` allows an attacker to create fake user profiles and forged notes. The spoofed users will appear to be from a different instance than the one where they actually exist, and the forged notes will appear to be posted by a different user. Vulnerable Misskey instances will accept the spoofed objects as valid, allowing an attacker to impersonate other users and instances.

Leer descripción completaMostrar menos

The attacker retains full control of the spoofed user / note and can interact like a real account. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 8.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.32%
Percentil entre todas las CVEs puntuadas: 22
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access85 %
Impacto principalT1078.003 Local Accountsstealth · persistence · privilege escalation · initial access80 %
Impacto secundarioT1087.004 Cloud Accountdiscovery70 %
Impacto secundarioT1565.003 Runtime Data Manipulationimpact75 %

Vector AV:N/PR:N/UI:N indica explotación remota sin autenticación previa (T1190). Falta de validación permite suplantar usuarios y forjar notas (T1078.003: cuenta falsa; T1565.003: manipulación de datos; T1087.004: enumeración de cuentas federadas).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User Account Management Privileged Account Management Network Segmentation Vulnerability Scanning Restrict File and Directory Permissions Password Policies

Tecnologías afectadas (1)

Misskey — Misskey

CWE

CWE-20

Referencias

https://github.com/misskey-dev/misskey/security/advisories/GHSA-m2gq-69fp-6hv4

JSON original (NVD)

Mostrar

{
  "id": "CVE-2024-52591",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-52591",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-19T17:08:23.183860Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.3,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.8,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "LOW",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "misskey-dev",
          "product": "misskey",
          "versions": [
            {
              "status": "affected",
              "version": "< 2024.11.0-alpha.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-12-18T20:15:23.697",
  "references": [
    {
      "url": "https://github.com/misskey-dev/misskey/security/advisories/GHSA-m2gq-69fp-6hv4",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` and `HttpRequestService.getActivityJson` allows an attacker to create fake user profiles and forged notes. The spoofed users will appear to be from a different instance than the one where they actually exist, and the forged notes will appear to be posted by a different user. Vulnerable Misskey instances will accept the spoofed objects as valid, allowing an attacker to impersonate other users and instances. The attacker retains full control of the spoofed user / note and can interact like a real account. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. There are no known workarounds for this vulnerability."
    },
    {
      "lang": "es",
      "value": "Misskey es una plataforma de redes sociales federada de código abierto. En las versiones afectadas, la falta de validación en `ApRequestService.signedGet` y `HttpRequestService.getActivityJson` permite a un atacante crear perfiles de usuario falsos y notas falsificadas. Los usuarios falsificados parecerán ser de una instancia diferente a la que realmente existen, y las notas falsificadas parecerán haber sido publicadas por un usuario diferente. Las instancias vulnerables de Misskey aceptarán los objetos falsificados como válidos, lo que permite a un atacante hacerse pasar por otros usuarios e instancias. El atacante conserva el control total del usuario/nota falsificados y puede interactuar como una cuenta real. Este problema se ha solucionado en la versión 2024.11.0-alpha.3. Se recomienda a los usuarios que actualicen. No existen workarounds conocidos para esta vulnerabilidad."
    }
  ],
  "lastModified": "2026-06-17T08:07:30.550",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "87F71DD8-FFC9-4029-AE69-087D436A4A30",
              "versionEndExcluding": "2024.11.0"
            },
            {
              "criteria": "cpe:2.3:a:misskey:misskey:2024.11.0:alpha0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1BF4BE35-2292-4FD3-BE70-1ECB93C759D5"
            },
            {
              "criteria": "cpe:2.3:a:misskey:misskey:2024.11.0:alpha1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E74599B9-F76E-40E2-A2BC-297FBCD4114A"
            },
            {
              "criteria": "cpe:2.3:a:misskey:misskey:2024.11.0:alpha2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43BB14C6-8368-49E6-A1EF-6218C7ED998C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}