Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:LSummary
CVE-2025-24897 is a high-severity CSRF (CWE-352) vulnerability in Misskey Misskey. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Steal Web Session Cookie (T1539); ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and SC-23 (Session Authenticity) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-24897 is a cross-site request forgery (CSRF) vulnerability affecting Misskey, an open source federated social media platform. It impacts versions starting from 12.109.0 up to but not including 2025.2.0-alpha.0. The issue arises from a lack of CSRF protection combined with improper security attributes in the authentication cookies of Bull's dashboard, exposing certain bull-board APIs to CSRF attacks. Associated weakness enumerations include CWE-352 (Cross-Site Request Forgery), CWE-614 (Sensitive Cookie in HTTPS Session Without 'Secure' Attribute), and CWE-1275 (Sensitive Cookie in HTTPS Session Without 'HttpOnly' Attribute).
The vulnerability has a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L), indicating network accessibility, low attack complexity, no required privileges, user interaction, changed scope, high integrity impact, and low availability impact. An attacker can exploit it by tricking an authenticated user—likely an administrator with access to the Bull dashboard—into interacting with a malicious webpage. This enables CSRF requests to bull-board APIs, allowing the addition of arbitrary jobs that could significantly disrupt availability and integrity.
Misskey fixed the vulnerability in version 2025.2.0-alpha.0. As a workaround, block all access to the /queue directory using a web application firewall (WAF). Additional details are provided in the GitHub security advisory at GHSA-38w6-vx8g-67pp and the fixing commit at 77e421029cb564a97f42b6e41c9edce49f79cecd.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3979
Vulnerability Data
Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some…
more
of the APIs of bull-board may be subject to CSRF attacks. There is a risk of this vulnerability being used for attacks with relatively large impact on availability and integrity, such as the ability to add arbitrary jobs. This vulnerability was fixed in 2025.2.0-alpha.0. As a workaround, block all access to the `/queue` directory with a web application firewall (WAF).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.3.2V3.5.1V10.2.1V3.3.1
Mitigating Controls (NIST 800-53 r5) AI
Establishing secure configuration settings for web components includes requiring appropriate SameSite attributes on sensitive cookies.
Proper SameSite settings on session cookies directly help protect the authenticity of communications sessions against cross-site misuse.
Requiring confidentiality protection for transmitted information forces use of HTTPS-only cookies via the Secure attribute, eliminating exposure of sensitive session data.
Access enforcement requires verifying that state-changing requests originate from the authenticated user rather than a forged cross-site source.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Setting the Secure attribute is a direct mechanism for protecting sensitive session data in transit over HTTPS.
Enforcing hardened configuration baselines includes requiring the Secure flag on sensitive cookies.
Secure SDLC practices directly require anti-CSRF controls such as tokens or SameSite attributes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing SameSite attributes but does not prevent the weakness.
By denying access to phishing or malicious sites, the control lowers the likelihood that a user will be tricked into submitting a forged request that performs an unintended action on another site.
Use of cryptography control mandates encryption in transit, which HTTPS provides, but does not specifically require the Secure cookie attribute.
Application security requirements can include cookie security settings, but the control is broader and does not explicitly mandate the Secure attribute.
Secure coding practices directly prevent missing the Secure attribute on sensitive cookies, though the control covers many other coding issues.
Secure authentication control requires protection of session credentials, directly addressed by setting the Secure flag on sensitive cookies.