Is CVE-2024-27927 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-27927 being exploited in the wild.

How severe is CVE-2024-27927?

Low severity, with a CVSS score of 3.1, published 6 March 2024.

Which products and versions are affected?

rsshub (npm) SEMVER:introduced=0,fixed=1.0.0-master.a429472.

Is there a fix for CVE-2024-27927?

Yes. rsshub (npm): upgrade to 1.0.0-master.a429472 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-27927 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-27927?

Check whether you run rsshub (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-27927: RSSHub SSRF in Mastodon, Zjol, and M4 routes

CVE-2024-27927 · Severity: low · CVSS 3.1 · Published 2024-03-06

RSSHub, an open-source RSS feed generator, is vulnerable to a security flaw that allows attackers to use the server as a proxy. By sending specially crafted requests, an attacker can force the server to connect to internal systems or external websites, potentially exposing private internal information or hiding the attacker's true location. This could also be used to launch denial-of-service attacks by forcing the server to download large files or repeatedly request data.

Technologies: rsshub (npm). Vendors: npm.

Quick answers

Is CVE-2024-27927 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-27927 being exploited in the wild.
How severe is CVE-2024-27927?: Low severity, with a CVSS score of 3.1, published 6 March 2024.
Which products and versions are affected?: rsshub (npm) SEMVER:introduced=0,fixed=1.0.0-master.a429472.
Is there a fix for CVE-2024-27927?: Yes. rsshub (npm): upgrade to 1.0.0-master.a429472 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-27927 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-27927?: Check whether you run rsshub (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

rsshub (npm): upgrade to 1.0.0-master.a429472 or later
```
npm install rsshub@1.0.0-master.a429472
```

Technical details

Multiple Server-Side Request Forgery (SSRF) vulnerabilities exist in RSSHub's /mastodon, /zjol, and /m4 routes due to insufficient validation of user-supplied parameters used in constructing outbound HTTP GET requests. Specifically, parameters like ':acct' in Mastodon routes and ':id' in Zjol/M4 routes are used to build target URLs without adequate sanitization, allowing an attacker to inject arbitrary hostnames. A remote, unauthenticated attacker can exploit this to scan internal network ports, leak the server's real IP address (bypassing CDNs), or perform DoS amplification by chaining requests or requesting large files. The vulnerability is addressed in version 1.0.0-master.a429472 by implementing host validation.

Affected products

DIYgod RSSHub < 1.0.0-master.a429472

Identifiers

CVE-2024-27927
GHSA-3p3p-cgj7-vgw3

Timeline

2024-03-05: advisory: Original GitHub Security Advisory published by vendor.
2024-03-06: disclosed: Public disclosure of the vulnerability.
2024-03-21: patched: NVD publication and patch confirmation.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.