Skip to content

CSRF vulnerability due to insecure configuration of authentication cookie attributes

High
samunohito published GHSA-38w6-vx8g-67pp Feb 11, 2025

Package

Misskey

Affected versions

>=12.109.0 <2025.2.0-alpha.0

Patched versions

2025.2.0-alpha.0

Description

Summary

CSRF対策の欠落と、ジョブキューのダッシュボードの認証用のCookieの不適切な設定により、bull-boardの一部のAPIにCSRF攻撃が成立する可能性があります。

Due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be subject to CSRF attacks.

Impact

  • bull-boardのAPIへのCSRF攻撃が可能になる可能性があります
    May allow CSRF attacks on bull-board APIs
    • 任意のジョブを追加できるなど、可用性や整合性に比較的大きな影響を与える攻撃に使われるリスクがあります
      Risk of being used for attacks with relatively large impact on availability and integrity, such as the ability to add arbitrary jobs

Workarounds

この脆弱性は2025.2.0で修正されています。Misskeyを2025.2.0以降にアップデートすることを推奨します。
This vulneability was fixed in 2025.2.0; upgrading Misskey to 2025.2.0 or later is strongly recommended.

  • /queue下へのアクセスをWAF等で全て遮断する
    Block all access to the /queue directory with WAF

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Changed
Confidentiality
None
Integrity
High
Availability
Low

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L

CVE ID

CVE-2025-24897

Weaknesses

Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. Learn more on MITRE.

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

The Secure attribute for sensitive cookies in HTTPS sessions is not set. Learn more on MITRE.

Sensitive Cookie with Improper SameSite Attribute

The SameSite attribute for sensitive cookies is not set, or an insecure value is used. Learn more on MITRE.

Credits