CVE-2024-52590 Overview
CVE-2024-52590 affects Misskey, an open source federated social media platform built on ActivityPub. The vulnerability stems from missing validation in the ApRequestService.signedGet function. Attackers can craft fake user profiles that appear to originate from a different federated instance than the one hosting them. Vulnerable instances accept these spoofed users as legitimate, enabling full impersonation of users on remote instances. The attacker retains complete control of the spoofed account and can post, renote, and interact as if operating a genuine account. Maintainers addressed the issue in version 2024.11.0-alpha.3, and no workarounds exist for unpatched deployments. This flaw is categorized under [CWE-20] Improper Input Validation.
Critical Impact
Attackers can impersonate arbitrary users on remote Misskey instances across the federated network, undermining identity trust in ActivityPub communications.
Affected Products
- Misskey versions prior to 2024.11.0-alpha.3
- Misskey 2024.8.0 release candidates (rc3, rc4, rc5)
- Misskey 2024.11.0 alpha builds (alpha0, alpha1, alpha2)
Discovery Timeline
- 2024-12-18 - CVE-2024-52590 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-52590
Vulnerability Analysis
Misskey implements the ActivityPub protocol to federate with other servers, including Mastodon, Pleroma, and other Misskey instances. The ApRequestService.signedGet method fetches remote ActivityPub objects using HTTP signatures. The function failed to validate that the returned actor object's authoritative origin matched the host from which it was retrieved. This gap in origin validation allowed a malicious instance to serve ActivityPub actor documents claiming to represent users hosted on a different, trusted instance.
Federated social platforms rely on origin binding to establish identity trust. When that binding breaks, downstream consumers cannot distinguish authentic actors from impersonators. Posts, boosts, and follow relationships created by the spoofed account appear authentic to other federation participants.
Root Cause
The root cause is improper input validation [CWE-20] in ApRequestService.signedGet. The service accepted actor documents whose declared id or host did not match the URL that was fetched. Without strict comparison between the requested host and the actor's canonical origin, the service treated attacker-controlled responses as authoritative for third-party domains.
Attack Vector
An attacker operating a malicious ActivityPub-capable server crafts a user object that declares itself as belonging to a legitimate target instance. The attacker then triggers a vulnerable Misskey instance to perform a signed GET against the malicious server. Because the response is not validated against the expected origin, the Misskey instance stores and renders the spoofed actor as if it were hosted on the target domain. The attacker then publishes content, interacts with other federated users, and conducts social engineering while impersonating a victim identity. See the GitHub Security Advisory GHSA-7vgr-p3vc-p4h2 for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2024-52590
Indicators of Compromise
- Duplicate actor entries for the same username referencing mismatched origin hosts in the Misskey database.
- Inbound ActivityPub fetches to actor URLs whose returned id field does not match the fetched hostname.
- Unexpected federation activity originating from unknown or newly observed remote instances.
Detection Strategies
- Audit stored remote actor records to compare the fetched URL host against each actor's canonical id host.
- Review web server and application logs for signed GET requests to ActivityPub endpoints returning actor objects for unrelated domains.
- Correlate posts attributed to known users with the originating instance to flag identity mismatches.
Monitoring Recommendations
- Enable verbose logging of federation fetches and signature verification outcomes.
- Monitor the Misskey application logs for errors or anomalies tied to ApRequestService operations.
- Alert on sudden spikes in remote actor creation from previously unseen federated hosts.
How to Mitigate CVE-2024-52590
Immediate Actions Required
- Upgrade all Misskey instances to version 2024.11.0-alpha.3 or later without delay.
- Inventory federated actors stored in the database and remove any whose declared origin does not match the fetching host.
- Notify federation peers of the upgrade so they can validate the integrity of previously received content.
Patch Information
Misskey maintainers released the fix in version 2024.11.0-alpha.3. The patch adds origin validation to ApRequestService.signedGet so that actor documents are accepted only when their canonical host matches the URL retrieved. Review the GitHub Security Advisory GHSA-7vgr-p3vc-p4h2 for the complete remediation details.
Workarounds
- No workarounds are available. Upgrading to the fixed version is the only supported remediation path.
- Operators who cannot upgrade immediately should consider temporarily restricting federation with untrusted instances using allowlist-based federation policies.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
