Misskey Cross-Site Request Forgery Vulnerability in Bull-Board API

A cross-site request forgery (CSRF) vulnerability has been identified in Misskey, an open-source federated social media platform. This issue affects versions 12.109.0 prior to 2025.2.0-alpha.0. The vulnerability arises from inadequate CSRF protection and improper security attributes in the authentication cookies used for Bull's dashboard. As a result, some APIs of bull-board may be susceptible to CSRF attacks, potentially leading to significant disruptions in availability and integrity, such as the unauthorized addition of jobs.

Impact

Exploitation of this vulnerability could allow CSRF attacks on bull-board APIs, with the potential to add arbitrary jobs, thereby causing considerable disruption to availability and integrity.

Remediation

Users are advised to upgrade Misskey to version 2025.2.0 or later. Additionally, block all access to the '/queue' directory using a web application firewall (WAF).