CVE-2024-56200: Altair Image Proxy DoS Vulnerability

CVE-2024-56200 Overview

CVE-2024-56200 affects Altair, a fork of Misskey v12 used as a decentralized social media server. The media proxy component, responsible for compressing and resizing remote files, lacks both request validation and authentication. Unauthenticated attackers can abuse this endpoint to trigger resource-intensive image processing operations. Repeated requests drive abnormal CPU consumption on the host and saturate outbound network bandwidth. The flaw is categorized as Uncontrolled Resource Consumption [CWE-400] and falls under Denial of Service vulnerability classifications. The maintainers fixed the issue in version v12.24Q4.1, and no workarounds exist for affected releases.

Critical Impact
Remote unauthenticated attackers can exhaust server CPU and network resources by abusing the unauthenticated image proxy, causing service unavailability.

Affected Products

Altair (fork of Misskey v12) versions prior to v12.24Q4.1
The vulnerable component is the internal MediaProxy defined in packages/backend/src/server/proxy/index.ts
Self-hosted Altair instances exposed to the public internet are at highest risk

Discovery Timeline

2024-12-19 - CVE-2024-56200 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-56200

Vulnerability Analysis

Altair exposes a media proxy endpoint that fetches remote images, decompresses them, and resizes them on demand. The proxy applies neither request validation nor authentication before performing these operations. Any anonymous client can request arbitrary remote URLs through the proxy and force the backend to allocate CPU cycles for image decoding and resizing. The processing cost per request is asymmetric: small attacker requests trigger large server-side workloads. An attacker scripting concurrent requests can quickly saturate CPU and outbound bandwidth. Because the attack scope changes (the proxy fetches third-party content), neighboring services and tenants on shared infrastructure may also be impacted.

Root Cause

The root cause is missing authentication and missing request validation on the media proxy route. The Koa middleware chain accepted any inbound request and proceeded directly to proxyMedia. There were no token checks, no user lookups, and no rate-limiting controls before the expensive media processing pipeline executed.

Attack Vector

The vulnerability is exploitable over the network with low complexity and no privileges. An attacker sends crafted HTTP GET requests to the media proxy endpoint, optionally targeting large remote files or images requiring expensive resampling. Repeating these requests in parallel drives CPU saturation, memory pressure, and outbound network amplification on the host.

typescript

// Security patch in packages/backend/src/server/proxy/index.ts
 import cors from "@koa/cors";
 import Router from "@koa/router";
 import { proxyMedia } from "./proxy-media.js";
+import { Users } from "@/models/index.js";
 
 // Init app
 const app = new Koa();
 app.use(cors());
 app.use(async (ctx, next) => {
+    const token = ctx.cookies.get("token");
+    if (token == null) {
+        ctx.status = 401;
+        return;
+    }
+
+    const user = await Users.findOneBy({ token });
+    if (user == null) {
+        ctx.status = 401;
+        return;
+    }
+
     ctx.set("Content-Security-Policy", "default-src 'none'; img-src 'self'; media-src 'self'; style-src 'unsafe-inline'");
     await next();
 });
// Source: https://github.com/nexryai/altair/commit/20bad5155a8d73f8d807c6c1ae0f7b8041331be8

The patch adds a Koa middleware that reads a token cookie, rejects requests lacking the cookie with HTTP 401, and validates the token against the Users table before any media processing proceeds.

Detection Methods for CVE-2024-56200

Indicators of Compromise

Sustained spikes in CPU utilization on Altair backend processes without corresponding legitimate user activity
High volumes of unauthenticated requests to the /proxy/ media endpoint
Outbound bandwidth spikes from the Altair server fetching arbitrary remote image URLs
Repeated HTTP 200 responses on media proxy routes from a small set of source IPs with no associated session cookies

Detection Strategies

Parse web server and reverse proxy access logs for requests to media proxy paths missing a session token cookie
Correlate process-level CPU spikes with concurrent request volume on the proxy endpoint
Apply anomaly detection on request rate per source IP against historic baselines for the media proxy

Monitoring Recommendations

Enable verbose access logging on the reverse proxy fronting Altair, capturing request URI, source IP, and cookie presence
Ship application and access logs to a centralized analytics platform for correlation with host CPU and network telemetry
Configure alerts when media proxy request rate exceeds historical norms or when sustained CPU usage exceeds defined thresholds

How to Mitigate CVE-2024-56200

Immediate Actions Required

Upgrade Altair to version v12.24Q4.1 or later, which adds authentication to the media proxy
Restrict access to the media proxy endpoint at the reverse proxy or WAF layer until the upgrade is applied
Apply per-IP rate limiting on the media proxy route to bound resource consumption
Review server CPU and outbound bandwidth metrics for the past 30 days to identify prior abuse

Patch Information

The maintainers released the fix in Altair v12.24Q4.1. The patch is implemented in commit 20bad5155a8d73f8d807c6c1ae0f7b8041331be8 and introduces token-based authentication middleware in packages/backend/src/server/proxy/index.ts. See the GitHub Security Advisory for Altair and the related Misskey Security Advisory for full details.

Workarounds

No vendor-supplied workarounds are available; upgrading to v12.24Q4.1 is the only supported remediation
As a compensating control, operators may block external access to the media proxy path at a reverse proxy, requiring an authenticated session cookie before forwarding requests
Enforce aggressive rate limits and connection caps on the proxy endpoint to reduce DoS amplification potential

bash

# Example nginx compensating control: require token cookie and rate-limit the media proxy
limit_req_zone $binary_remote_addr zone=mediaproxy:10m rate=5r/s;

location /proxy/ {
    if ($cookie_token = "") {
        return 401;
    }
    limit_req zone=mediaproxy burst=10 nodelay;
    proxy_pass http://altair_backend;
}