CVE-2024-27927 (published 2024-03-21T02:52Z)

RSSHub is an open source RSS feed generator. Prior to version 1.0.0-master.a429472, RSSHub allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network or conduct Denial-of-Service (DoS) attacks. The attacker can send malicious requests to a RSSHub server, to make the server send HTTP GET requests to arbitrary destinations and see partial responses. This may lead to leak the server IP address, which could be hidden behind a CDN; retrieving information in the internal network, e.g. which addresses/ports are accessible, the titles and meta descriptions of HTML pages; and denial of service amplification. The attacker could request the server to download some large files, or chain several SSRF requests in a single attacker request.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/DIYgod/RSSHub
commit_details: repo_url: https://github.com/DIYgod/RSSHub
author: Yufan You
author_date: 2024-03-05 17:27:51+08:00
msg: Merge pull request from GHSA-3p3p-cgj7-vgw3

* fix: SSRF in /m4/:id?/:category*

* fix: allow /mastodon/acct/ to any domain when MASTODON_API_HOST is set

* fix: add missing import for isValidHost
repository: repo_url: https://github.com/DIYgod/RSSHub
repo_name: DIYgod/RSSHub
description: 🧡 Everything is RSSible
repo_language: TypeScript
owner: DIYgod
file_changes: filename: index.ts
change_type: ModificationType.MODIFY
diff: @@ -4,6 +4,7 @@ const __dirname = getCurrentPath(import.meta.url);
 
 import cache from '@/utils/cache';
 import got from '@/utils/got';
+import { isValidHost } from '@/utils/valid-host';
 import { load } from 'cheerio';
 import timezone from '@/utils/timezone';
 import { parseDate } from '@/utils/parse-date';
@@ -12,6 +13,9 @@ import * as path from 'node:path';
 
 export default async (ctx) => {
     const { id = 'news', category = 'china' } = ctx.req.param();
+    if (!isValidHost(id)) {
+        throw new Error('Invalid id');
+    }
     const limit = ctx.req.query('limit') ? Number.parseInt(ctx.req.query('limit'), 10) : 30;
 
     const rootUrl = `http://${id}.m4.cn`;

programming_language: TypeScript
filename: acct.ts
change_type: ModificationType.MODIFY
diff: @@ -1,14 +1,8 @@
 const utils = require('./utils');
-import { config } from '@/config';
 
 export default async (ctx) => {
     const acct = ctx.req.param('acct');
     const only_media = ctx.req.param('only_media') ? 'true' : 'false';
-    const acctSite = acct.split('@').filter(Boolean)[1];
-
-    if (!config.feature.allow_user_supply_unsafe_domain && !utils.allowSiteList.includes(acctSite)) {
-        throw new Error(`This RSS is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true'.`);
-    }
 
     const { site, account_id } = await utils.getAccountIdByAcct(acct);
 

programming_language: JavaScript
filename: utils.ts
change_type: ModificationType.MODIFY
diff: @@ -4,7 +4,7 @@ import got from '@/utils/got';
 import { parseDate } from '@/utils/parse-date';
 import { config } from '@/config';
 
-const allowSiteList = ['mastodon.social', 'pawoo.net', config.mastodon.apiHost];
+const allowSiteList = ['mastodon.social', 'pawoo.net', config.mastodon.apiHost].filter(Boolean);
 
 const apiHeaders = (site) => {
     const { accessToken, apiHost } = config.mastodon;
@@ -96,6 +96,9 @@ async function getAccountIdByAcct(acct) {
     if (!(site && acctDomain)) {
         throw new Error('Mastodon RSS is disabled due to the lack of <a href="https://docs.rsshub.app/en/install/#configuration-route-specific-configurations">relevant config</a>');
     }
+    if (!config.feature.allow_user_supply_unsafe_domain && !allowSiteList.includes(site)) {
+        throw new Error(`RSS for this domain is disabled unless 'ALLOW_USER_SUPPLY_UNSAFE_DOMAIN' is set to 'true' or 'MASTODON_API_HOST' is set.`);
+    }
 
     const search_url = `https://${site}/api/v2/search`;
     const cacheUid = `mastodon_acct_id/${site}/${acct}`;

programming_language: TypeScript