Uncontrolled Recursion and Asymmetric Resource Consumption (Amplification) in media/file proxy in Misskey

published 2024-12-18 22 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-43810

cvss: 7.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 25%
public exploits: 0; none known

Misskey is an open source, federated social media platform. In affected versions FileServerService (media proxy) in github.com/misskey-dev/misskey 2024.10.1 or earlier did not detect proxy loops, which allows remote actors to execute a self-propagating reflected/amplified distributed denial-of-service via a maliciously crafted note. FileServerService.prototype.proxyHandler did not check incoming requests are not coming from another proxy server. An attacker can execute an amplified denial-of-service by sending a nested proxy request to the server and end the request with a malicious redirect back to another nested proxy request. Leading to unbounded recursion until the original request is timed out. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. Users unable to upgrade may configure the reverse proxy to block requests to the proxy with an empty User-Agent header or one containing Misskey/. An attacker can not effectively modify the User-Agent header without making another request to the server.

Patch / fix

fixed in 1

misskey misskey 2024.11.0-alpha.3

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 22 mo ago (2024-12-19)

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

Affected products

misskey-dev misskey

Classification

Weakness

CWE-405 Asymmetric Resource Consumption (Amplification)
CWE-674 Uncontrolled Recursion

References

github.com /misskey-dev/misskey/security/advisories/GHSA-gq5q-c77c-v236

Sources

CVE List CVE-2024-49363
NVD CVE-2024-49363

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary