SB2023112511 - Improper Verification of Cryptographic Signature in Misskey

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2023-49079)

The vulnerability allows a remote attacker to impersonate any remote user.

The vulnerability exists due to improper verification of cryptographic signature in inbox signature verification when processing ActivityPub server-to-server federation requests. A remote attacker can send a crafted request with spoofed signature-related headers to impersonate any remote user.

The issue occurs because only the HTTP message signature is validated, while headers such as Digest and Host are not properly validated.

Remediation

Install update from vendor's website.

References

• https://github.com/misskey-dev/misskey/security/advisories/GHSA-3f39-6537-3cgc
• https://github.com/advisories/GHSA-3f39-6537-3cgc