Server-Side Request Forgery (SSRF) in Misskey - CVE-2024-52579
Published: December 18, 2024 / Updated: April 28, 2026
Vulnerability identifier: #VU128334
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N]
CVE-ID: CVE-2024-52579
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to send requests to internal servers.
The vulnerability exists due to insufficient restriction of request destinations in HttpRequestService when handling API requests that fetch user-supplied URLs. A remote user can supply a crafted URL to send requests to internal servers.
The issue affects some APIs and allows GET or POST requests with some controllable URL parameters to private IP addresses.
Affected software
Misskey
How to mitigate CVE-2024-52579
Install security update from vendor's website.
Misskey - update to 2024.11.0 alpha.3