Server-Side Request Forgery (SSRF) Affecting rsshub package, versions <1.0.0-master.a429472
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-RSSHUB-6417982
- published 7 Mar 2024
- disclosed 6 Mar 2024
- credit Yufan You
Introduced: 6 Mar 2024
CVE-2024-27927 Open this link in a new tabHow to fix?
Upgrade rsshub to version 1.0.0-master.a429472 or higher.
Overview
rsshub is a Make RSS Great Again!
Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) due to improper validation of user-supplied URLs in several endpoints. An attacker can leverage this vulnerability to use the server as a proxy for sending HTTP GET requests to arbitrary destinations, potentially leading to information disclosure from the internal network or facilitating Denial-of-Service (DoS) attacks by causing the server to request large files or chaining multiple requests.