CVE-2024-49363

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-49363
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-49363.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-49363
Aliases
  • GHSA-gq5q-c77c-v236
Published
2024-12-18T19:24:34.399Z
Modified
2025-12-01T13:54:16.296787Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H CVSS Calculator
Summary
Uncontrolled Recursion and Asymmetric Resource Consumption (Amplification) in media/file proxy in Misskey
Details

Misskey is an open source, federated social media platform. In affected versions FileServerService (media proxy) in github.com/misskey-dev/misskey 2024.10.1 or earlier did not detect proxy loops, which allows remote actors to execute a self-propagating reflected/amplified distributed denial-of-service via a maliciously crafted note. FileServerService.prototype.proxyHandler did not check incoming requests are not coming from another proxy server. An attacker can execute an amplified denial-of-service by sending a nested proxy request to the server and end the request with a malicious redirect back to another nested proxy request. Leading to unbounded recursion until the original request is timed out. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. Users unable to upgrade may configure the reverse proxy to block requests to the proxy with an empty User-Agent header or one containing Misskey/. An attacker can not effectively modify the User-Agent header without making another request to the server.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49363.json",
    "cwe_ids": [
        "CWE-405",
        "CWE-674"
    ]
}
References

Affected packages

Git / github.com/misskey-dev/misskey

Affected ranges

Type
GIT
Repo
https://github.com/misskey-dev/misskey
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e55a254353b608795386ae5efe1104f1177e6fd6
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "< CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H"
        }
    ]
}

Affected versions

0.*

0.0.5018
0.0.5023
0.0.5030
0.0.5042
0.0.5051
0.0.5064
0.0.5074
0.0.5089

1.*

1.0.0
1.1.0
1.2.0
1.3.0
1.4.0
1.5.0
1.6.0
1.7.0

2.*

2.0.0
2.1.1
2.1.2
2.1.3
2.1.4
2.10.0
2.10.1
2.11.0
2.12.0
2.13.0
2.14.0
2.15.0
2.16.0
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.16.7
2.16.8
2.17.0
2.18.0
2.18.2
2.19.0
2.2.0
2.20.0
2.20.1
2.21.0
2.21.1
2.22.0
2.22.1
2.22.2
2.22.3
2.23.0
2.24.0
2.24.1
2.24.2
2.25.1
2.25.2
2.27.3
2.29.0
2.29.1
2.3.0
2.3.1
2.30.0
2.30.1
2.31.0
2.32.0
2.33.0
2.33.1
2.34.0
2.34.1
2.34.3
2.35.1
2.35.2
2.35.3
2.36.1
2.37.1
2.37.2
2.37.3
2.37.4
2.37.5
2.37.6
2.37.7
2.38.2
2.38.3
2.4.0
2.40.0
2.40.1
2.41.1
2.42.0
2.5.0
2.6.2
2.7.1
2.9.0
2.9.1

3.*

3.0.1
3.1.0