CVE-2023-52077
📋 TL;DR
Nexkey, a lightweight fork of Misskey, allowed external applications using administrator or moderator tokens to call administrative APIs. This vulnerability enables malicious third-party apps to modify server settings and potentially compromise sensitive credentials like object storage and email server access. All Nexkey servers running versions prior to 12.23Q4.5 are affected.
💻 Affected Systems
- Nexkey
📦 What is this software?
Nexkey by Nexryai
⚠️ Risk & Real-World Impact
Worst Case
Complete server takeover: attackers could reconfigure server settings, steal object storage credentials (potentially exposing all stored files), compromise email server credentials, and perform other administrative actions leading to data breach and service disruption.
Likely Case
Unauthorized administrative actions: malicious apps could modify server configurations, disable security features, or access sensitive administrative functions without proper authorization.
If Mitigated
Limited impact if proper token management and app review processes are in place, though the vulnerability still represents a significant privilege escalation risk.
🎯 Exploit Status
Exploitation requires an attacker to trick an administrator or moderator into authorizing a malicious third-party application, or compromise an existing authorized application. Once authorized, the malicious app can call admin APIs using the granted token.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.23Q4.5
Vendor Advisory: https://github.com/nexryai/nexkey/security/advisories/GHSA-pjj7-7hcj-9cpc
Restart Required: Yes
Instructions:
1. Backup your Nexkey instance and database. 2. Update to version 12.23Q4.5 or later using your package manager or by pulling the latest code from the repository. 3. Restart the Nexkey service. 4. Verify the update was successful by checking the version.
🔧 Temporary Workarounds
Revoke all third-party application tokens
allImmediately revoke all tokens issued to third-party applications, especially those granted to administrators and moderators.
Navigate to Settings > Security > Sessions in your Nexkey instance and revoke all third-party application tokens
Restrict admin/moderator token usage
allTemporarily disable or restrict the ability for administrators and moderators to authorize third-party applications.
Modify configuration to disable OAuth/API token generation for privileged users until patched
🧯 If You Can't Patch
- Immediately revoke all third-party application tokens issued to administrators and moderators
- Implement network-level controls to restrict API access from external applications
- Monitor admin API logs for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check your Nexkey version. If it's earlier than 12.23Q4.5, you are vulnerable.Check Version:
Check the version in the Nexkey web interface under Settings > About, or examine the package version in your system's package manager.Verify Fix Applied:
After updating, verify the version is 12.23Q4.5 or later and test that third-party applications can no longer call admin APIs with regular user tokens.📡 Detection & Monitoring
Log Indicators:
- Unauthorized admin API calls from third-party applications
- Admin API access from non-admin user contexts
- Suspicious configuration changes via API
Network Indicators:
- External applications making requests to admin API endpoints
- Unusual API call patterns to sensitive endpoints
SIEM Query:
source="nexkey" AND (api_endpoint="/api/admin/*" OR api_endpoint="/api/moderator/*") AND user_role!="admin"🔗 References
- https://github.com/mei23/misskey-v12/commit/78173e376f14fcc1987b02196f5538bf5b18225c
- https://github.com/misskey-dev/misskey/commit/5150053275594278e9eb23e72d98b16593c4c230
- https://github.com/nexryai/nexkey/commit/a4e4c9c47c5f84ec7ccd309bde59d4ae5d7e5a98
- https://github.com/nexryai/nexkey/security/advisories/GHSA-pjj7-7hcj-9cpc
- https://github.com/mei23/misskey-v12/commit/78173e376f14fcc1987b02196f5538bf5b18225c
- https://github.com/misskey-dev/misskey/commit/5150053275594278e9eb23e72d98b16593c4c230
- https://github.com/nexryai/nexkey/commit/a4e4c9c47c5f84ec7ccd309bde59d4ae5d7e5a98
- https://github.com/nexryai/nexkey/security/advisories/GHSA-pjj7-7hcj-9cpc
