CVE-2023-22493 RSSHub is vulnerable to SSRF (Server-Side Request Forgery)
Attackers can exploit SSRF in RSSHub to send arbitrary HTTP requests from the server, potentially accessing sensitive internal network resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-22493?
CVE-2023-22493 is a high-severity server-side request forgery vulnerability in DIYgod RSSHub, published on 13 Jan 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
RSSHub is an open source RSS feed generator. RSSHub is vulnerable to Server-Side Request Forgery (SSRF) attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers or resources on the network. An attacker can exploit this vulnerability by sending a request to the affected routes with a malicious URL. An attacker could also use this vulnerability to send requests to internal or any other servers or resources on the network, potentially gain access to sensitive information that would not normally be accessible and amplifying the impact of the attack. The patch for this issue can be found in commit a66cbcf.
Weakness: CWE-918
Which versions are affected by CVE-2023-22493?
2 open source packages ship an affected version, including rsshub. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rsshub npm | All versions | 1.0.0-master.a66cbcf |
rsshub npm | All versions | 1.0.0-master.a66cbcf |
Products include Rsshub Rsshub.
How do I fix CVE-2023-22493?
Upgrade rsshub to 1.0.0-master.a66cbcf or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2023-22493 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-22493 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in DIYgod RSSHub
- CVE-2021-21278 Risk of code injection in RSSHub
- CVE-2024-27927 RSSHub vulnerable to SSRF in /mastodon, /zjoi, and /m4
- CVE-2024-27926 RSSHub Cross-site Scripting vulnerability caused by internal media proxy
- CVE-2023-26491 RSSHub is vulnerable to cross-site scripting (XSS) via unvalidated URL parameters
- CVE-2022-31110 Denial of Service (DoS) vulnerability in RSSHub
Sources
Also known as GHSA-64wp-jh9p-5cg2.