CVE-2025-24900: Concorde Authentication Bypass Vulnerability

CVE-2025-24900 Overview

CVE-2025-24900 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Concorde (formerly known as Nexkey), a fork of the federated microblogging platform Misskey. The vulnerability stems from a lack of CSRF countermeasures combined with improper cookie configuration for MediaProxy authentication, enabling attackers to bypass authentication mechanisms under certain circumstances.

Critical Impact

This vulnerability allows attackers to bypass MediaProxy authentication and load any image without restrictions. In older versions (prior to 12.24Q2.3), the same cookie was used to authenticate the job queue management page (bull-board), enabling authentication bypass that can significantly impact system availability and integrity.

Affected Products

• Concorde (formerly Nexkey) versions prior to 12.25Q1.1
• Concorde versions prior to 12.24Q2.3 (also affected by bull-board authentication bypass)
• Federated instances running vulnerable Concorde deployments

Discovery Timeline

• 2025-02-11 - CVE-2025-24900 published to NVD
• 2025-02-11 - Last updated in NVD database

Technical Details for CVE-2025-24900

Vulnerability Analysis

This vulnerability is classified as CWE-352 (Cross-Site Request Forgery). The core issue lies in the authentication cookie for MediaProxy lacking the SameSite attribute, a critical security mechanism that prevents cross-origin requests from including cookies automatically.

When cookies are set without the SameSite attribute (or with SameSite=None), browsers will include these cookies in cross-site requests. This allows a malicious website to craft requests to the vulnerable Concorde instance that will automatically include the victim's authentication cookies, effectively bypassing the intended authentication controls.

The impact extends beyond simple image loading in older versions. Prior to version 12.24Q2.3, the same vulnerable cookie was used to authenticate access to bull-board, the job queue management interface. Bull-board provides administrative capabilities over background job processing, meaning a successful bypass could allow attackers to manipulate job queues, potentially affecting system availability and data integrity.

Root Cause

The root cause of this vulnerability is twofold:

1. Missing SameSite Cookie Attribute: The authentication cookie used for MediaProxy does not include the SameSite attribute, which modern browsers rely on to prevent cross-site request forgery attacks.

2. Shared Authentication Cookie: In versions prior to 12.24Q2.3, the same authentication cookie was reused for both MediaProxy and bull-board authentication, amplifying the impact of the vulnerability.

The absence of other CSRF countermeasures (such as CSRF tokens, Origin header validation, or Referer header checks) meant there was no defense-in-depth to compensate for the missing cookie security attribute.

Attack Vector

The attack is network-based and can be executed remotely without any privileges or user interaction required. An attacker could exploit this vulnerability through the following scenario:

1. The attacker hosts a malicious webpage containing crafted requests to the target Concorde instance
2. When a victim with an active session on the Concorde instance visits the malicious page, their browser automatically includes the authentication cookie
3. The Concorde server processes the request as authenticated, bypassing the intended access controls
4. The attacker can leverage this to load arbitrary images through MediaProxy or, in older versions, access bull-board administrative functions

The vulnerability is particularly concerning because it enables cross-origin attacks against federated social media infrastructure, where images and media from multiple sources are routinely proxied.

Detection Methods for CVE-2025-24900

Indicators of Compromise

• Unusual MediaProxy requests originating from unexpected referrer domains
• Cross-origin requests to MediaProxy endpoints with valid authentication cookies
• Anomalous access patterns to bull-board management interface from external origins
• Log entries showing authenticated requests with suspicious or missing Origin headers

Detection Strategies

• Monitor HTTP request logs for MediaProxy endpoints with external Referer headers while carrying valid session cookies
• Implement alerting on bull-board access from origins outside the expected domain
• Review web application firewall (WAF) logs for patterns indicative of CSRF exploitation attempts
• Deploy Content Security Policy (CSP) violation reporting to detect potential attack pages

Monitoring Recommendations

• Enable detailed logging for all authentication-related endpoints including MediaProxy and bull-board
• Configure alerts for spikes in cross-origin authenticated requests
• Monitor for new or unusual job queue entries in bull-board that may indicate unauthorized access
• Implement real-time monitoring of session cookie usage patterns for anomaly detection

How to Mitigate CVE-2025-24900

Immediate Actions Required

• Update Concorde to version 12.25Q1.1 or later immediately
• Audit logs for any signs of prior exploitation
• Invalidate existing session cookies after updating to force re-authentication
• Review bull-board job queues for any unauthorized or suspicious entries

Patch Information

The Concorde maintainers have released version 12.25Q1.1 which contains the security fix for this vulnerability. The patch addresses the issue by properly setting the SameSite attribute on authentication cookies, preventing browsers from including them in cross-site requests.

Security patches are available in the following commits:

• Security patch commit 2309b4a
• Security patch commit f3f54bd

For full details, refer to the GitHub Security Advisory GHSA-5hgq-9vw8-7v87.

Workarounds

• No effective workaround exists other than updating to the patched version
• The maintainers strongly recommend not using older versions of Concorde
• Consider temporarily restricting access to bull-board via network-level controls until patching is complete
• Implement a web application firewall (WAF) rule to block requests with suspicious cross-origin patterns as a temporary measure

# Update Concorde to the patched version
# Navigate to your Concorde installation directory
cd /path/to/concorde

# Pull the latest changes including security patches
git fetch origin
git checkout 12.25Q1.1

# Rebuild and restart the application
npm install
npm run build
systemctl restart concorde