CVE-2022-31110 Denial of Service (DoS) vulnerability in RSSHub
Attackers can cause high CPU usage and denial of service in RSSHub by passing special values to filter parameters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-31110?
CVE-2022-31110 is a medium-severity denial of service vulnerability in DIYgod RSSHub, published on 29 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
RSSHub is an open source, extensible RSS feed generator. In commits prior to 5c4177441417 passing some special values to the `filter` and `filterout` parameters can cause an abnormally high CPU. This results in an impact on the performance of the servers and RSSHub services which may lead to a denial of service. This issue has been fixed in commit 5c4177441417 and all users are advised to upgrade. There are no known workarounds for this issue.
Which versions are affected by CVE-2022-31110?
2 open source packages ship an affected version, including rsshub. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rsshub npm | All versions to 1.0.0 | None |
rsshub npm | All versions to 1.0.0 | None |
Products include Rsshub Rsshub.
How do I fix CVE-2022-31110?
No fix has been published for CVE-2022-31110 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-31110 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31110 exists.
Other vulnerabilities in DIYgod RSSHub
- CVE-2023-22493 RSSHub is vulnerable to SSRF (Server-Side Request Forgery)
- CVE-2021-21278 Risk of code injection in RSSHub
- CVE-2024-27927 RSSHub vulnerable to SSRF in /mastodon, /zjoi, and /m4
- CVE-2024-27926 RSSHub Cross-site Scripting vulnerability caused by internal media proxy
- CVE-2023-26491 RSSHub is vulnerable to cross-site scripting (XSS) via unvalidated URL parameters
Sources
Also known as GHSA-jvxx-v45p-v5vf.