Executive brief
RSSHub is a popular RSS aggregation service that fetches and transforms content feeds from various websites. An attacker can exploit a server-side request forgery (SSRF) vulnerability to trick the RSSHub server into making arbitrary HTTP requests to internal or external servers, potentially exposing sensitive information or enabling further attacks on the infrastructure.
Technical details
RSSHub contains an SSRF vulnerability (CWE-918) in its route handlers that accept user-supplied URLs. An attacker can craft a malicious URL using URL-encoded characters (e.g., %2F and %23 for / and #) to bypass URL validation logic and modify the base URL from https://${input}.defined.host to https://ATTACKER.HOST/#.defined.host, causing the server to send HTTP requests to an attacker-controlled domain. The vulnerability requires user interaction (a victim visiting a malicious link or form) and is reachable over the network without authentication. An attacker can use this to access internal services, exfiltrate sensitive data, or perform attacks against the server's network. A fix was released in commit a66cbcf (version 1.0.0-master.a66cbcf).
Affected products
- DIYgod RSSHub before commit a66cbcf
Timeline
- 2023-01-11: disclosed
- 2023-01-11: patched: Fix released in commit a66cbcf