Junglewise Threat Intelligence

CVE-2024-27927: RSSHub SSRF in Mastodon, Zjol, and M4 routes

CVE-2024-27927 · Severity: low · CVSS 3.1 · Published 2024-03-06

Technologies: rsshub (npm). Vendors: npm.

Executive brief

RSSHub, an open-source RSS feed generator, is vulnerable to a security flaw that allows attackers to use the server as a proxy. By sending specially crafted requests, an attacker can force the server to connect to internal systems or external websites, potentially exposing private internal information or hiding the attacker's true location. This could also be used to launch denial-of-service attacks by forcing the server to download large files or repeatedly request data.

Technical details

Multiple Server-Side Request Forgery (SSRF) vulnerabilities exist in RSSHub's /mastodon, /zjol, and /m4 routes due to insufficient validation of user-supplied parameters used in constructing outbound HTTP GET requests. Specifically, parameters like ':acct' in Mastodon routes and ':id' in Zjol/M4 routes are used to build target URLs without adequate sanitization, allowing an attacker to inject arbitrary hostnames. A remote, unauthenticated attacker can exploit this to scan internal network ports, leak the server's real IP address (bypassing CDNs), or perform DoS amplification by chaining requests or requesting large files. The vulnerability is addressed in version 1.0.0-master.a429472 by implementing host validation.

Affected products

  • DIYgod RSSHub < 1.0.0-master.a429472

Timeline

  • 2024-03-05: advisory: Original GitHub Security Advisory published by vendor.
  • 2024-03-06: disclosed: Public disclosure of the vulnerability.
  • 2024-03-21: patched: NVD publication and patch confirmation.

References

Related threats