Is CVE-2023-22493 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-22493 being exploited in the wild.

How severe is CVE-2023-22493?

Low severity, with a CVSS score of 3.1, published 11 January 2023.

Which products and versions are affected?

rsshub (npm) SEMVER:introduced=0,fixed=1.0.0-master.a66cbcf.

Is there a fix for CVE-2023-22493?

Yes. rsshub (npm): upgrade to 1.0.0-master.a66cbcf or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-22493 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2023-22493?

Check whether you run rsshub (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-22493: RSSHub server-side request forgery

CVE-2023-22493 · Severity: low · CVSS 3.1 · Published 2023-01-11

RSSHub is a popular RSS aggregation service that fetches and transforms content feeds from various websites. An attacker can exploit a server-side request forgery (SSRF) vulnerability to trick the RSSHub server into making arbitrary HTTP requests to internal or external servers, potentially exposing sensitive information or enabling further attacks on the infrastructure.

Technologies: rsshub (npm). Vendors: npm.

Quick answers

Is CVE-2023-22493 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-22493 being exploited in the wild.
How severe is CVE-2023-22493?: Low severity, with a CVSS score of 3.1, published 11 January 2023.
Which products and versions are affected?: rsshub (npm) SEMVER:introduced=0,fixed=1.0.0-master.a66cbcf.
Is there a fix for CVE-2023-22493?: Yes. rsshub (npm): upgrade to 1.0.0-master.a66cbcf or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-22493 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2023-22493?: Check whether you run rsshub (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

rsshub (npm): upgrade to 1.0.0-master.a66cbcf or later
```
npm install rsshub@1.0.0-master.a66cbcf
```

Technical details

RSSHub contains an SSRF vulnerability (CWE-918) in its route handlers that accept user-supplied URLs. An attacker can craft a malicious URL using URL-encoded characters (e.g., %2F and %23 for / and #) to bypass URL validation logic and modify the base URL from https://${input}.defined.host to https://ATTACKER.HOST/#.defined.host, causing the server to send HTTP requests to an attacker-controlled domain. The vulnerability requires user interaction (a victim visiting a malicious link or form) and is reachable over the network without authentication. An attacker can use this to access internal services, exfiltrate sensitive data, or perform attacks against the server's network. A fix was released in commit a66cbcf (version 1.0.0-master.a66cbcf).

Affected products

DIYgod RSSHub before commit a66cbcf

Identifiers

CVE-2023-22493
GHSA-64wp-jh9p-5cg2

Timeline

2023-01-11: disclosed
2023-01-11: patched: Fix released in commit a66cbcf

References

https://github.com/DIYgod/RSSHub/security/advisories/GHSA-64wp-jh9p-5cg2

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.