CVE-2024-52591: Misskey Auth Bypass Vulnerability

CVE-2024-52591 Overview

CVE-2024-52591 is an Improper Input Validation vulnerability affecting Misskey, an open source federated social media platform. The vulnerability exists in the ApRequestService.signedGet and HttpRequestService.getActivityJson functions, where missing validation allows attackers to create fake user profiles and forged notes that appear to originate from different instances than their actual source.

Critical Impact

This vulnerability enables complete user and instance impersonation across the Misskey fediverse, allowing attackers to create spoofed profiles that appear legitimate while retaining full control over the malicious accounts.

Affected Products

• Misskey versions prior to 2024.11.0-alpha.3
• Misskey 2024.11.0-alpha0
• Misskey 2024.11.0-alpha1
• Misskey 2024.11.0-alpha2

Discovery Timeline

• 2024-12-18 - CVE CVE-2024-52591 published to NVD
• 2025-11-26 - Last updated in NVD database

Technical Details for CVE-2024-52591

Vulnerability Analysis

This vulnerability stems from missing validation in critical ActivityPub request handling functions within Misskey's codebase. The ApRequestService.signedGet and HttpRequestService.getActivityJson functions fail to properly verify the authenticity and origin of incoming ActivityPub objects. This allows malicious actors to craft specially formed ActivityPub payloads that misrepresent the source instance and user identity.

When a vulnerable Misskey instance receives these spoofed objects, it accepts them as legitimate without proper validation checks. The spoofed users will appear to be from a different instance than where they actually exist, and forged notes will appear to be posted by different users. This fundamentally undermines the trust model of the federated social media ecosystem.

Root Cause

The root cause is CWE-20 (Improper Input Validation) in the ActivityPub request processing pipeline. The affected functions do not adequately validate that the claimed origin of ActivityPub objects matches their actual source. Specifically, the signed HTTP requests and activity JSON payloads lack proper verification of the actor and origin instance information, allowing an attacker to forge these values while maintaining valid signatures from their own controlled instance.

Attack Vector

The attack is conducted over the network without requiring any authentication or user interaction. An attacker operates a malicious Misskey instance or crafts raw ActivityPub requests that contain forged identity information. When these requests are sent to vulnerable Misskey instances, the lack of validation allows the spoofed content to be processed and displayed as if it originated from the impersonated user or instance.

The attacker retains full control over the spoofed user and note objects, meaning they can continue to interact with other users as the impersonated identity, post additional forged content, and potentially conduct social engineering attacks against users who trust the spoofed identity.

Detection Methods for CVE-2024-52591

Indicators of Compromise

• Unexpected or suspicious user profiles appearing to originate from known trusted instances with inconsistent behavior patterns
• Notes or activities attributed to users that those users deny creating
• ActivityPub requests where the claimed actor origin does not match the actual request source IP or domain
• User reports of impersonation or content they did not create appearing under their identity

Detection Strategies

• Implement network monitoring to compare ActivityPub request source IPs against claimed origin instances
• Enable detailed logging of all incoming ActivityPub requests including full headers and payload data
• Cross-reference user activities with instance administrators when suspicious activity is detected
• Monitor for sudden appearance of user profiles from instances that should already be federated

Monitoring Recommendations

• Enable verbose logging for ApRequestService and HttpRequestService components
• Set up alerts for ActivityPub requests with mismatched origin claims
• Regularly audit federated user profiles for anomalies or duplicate identities
• Establish communication channels with other instance administrators for coordinated threat detection

How to Mitigate CVE-2024-52591

Immediate Actions Required

• Upgrade Misskey to version 2024.11.0-alpha.3 or later immediately
• Review existing federated user accounts for signs of spoofing or impersonation
• Alert your user base about the potential for spoofed accounts and encourage verification of suspicious communications
• Contact administrators of federated instances to coordinate vulnerability remediation

Patch Information

This vulnerability has been addressed in Misskey version 2024.11.0-alpha.3. The fix implements proper validation in the ApRequestService.signedGet and HttpRequestService.getActivityJson functions to ensure that ActivityPub objects are properly authenticated and their origin claims are verified. Users are strongly advised to upgrade to this version or later. For more details, refer to the GitHub Security Advisory.

Workarounds

• There are no known workarounds for this vulnerability according to the vendor advisory
• Temporary defederation from untrusted or unknown instances may reduce exposure but is not a complete mitigation
• Increased manual review of new federated accounts and content can help identify spoofing attempts
• Consider temporarily restricting federation to only well-known and trusted instances until the patch can be applied