Executive brief
RSSHub is an open-source tool used to generate RSS feeds from various websites. A security flaw exists where the application fails to properly clean up web addresses containing special characters before displaying them on an error page. If a user is tricked into clicking a specially crafted link, an attacker could execute malicious scripts in the user's browser, potentially leading to unauthorized actions or data theft within the context of the RSSHub session.
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in RSSHub's middleware parameter handling. When a user provides an invalid 'brief' URL parameter containing malicious scripts, the application reflects the unvalidated input directly into an HTML error message. This occurs in 'lib/middleware/parameter.js' where the 'ctx.query.brief' value was previously included in a template string without proper sanitization or encoding. An attacker can exploit this by distributing a crafted URL to victims, executing arbitrary JavaScript in the context of the victim's browser session. The issue was resolved by removing the raw parameter input from the error response.
Affected products
- DIYgod RSSHub versions before commit c910c4d28717fb860fbe064736641f379fab2c91
Timeline
- 2023-02-28: advisory: Project maintainer published security advisory
- 2023-03-01: disclosed: Public disclosure of GHSA-32gr-4cq6-5w5q
- 2023-03-03: advisory: NVD published CVE-2023-26491