PT-2023-21232 · Miniflux · Miniflux

40826D · Published 2023-03-17 · Updated 2025-04-02 · CVE-2023-27592

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Miniflux versions 2.0.25 through 2.0.42

Description The issue arises when Miniflux automatically proxies images served over HTTP to prevent mixed content errors. If an outbound request made by the Go HTTP client fails, the html.ServerError is returned unescaped without the expected Content Security Policy header. An attacker can create an RSS feed item with an <img> tag containing a srcset attribute pointing to an invalid URL, coercing the proxy handler into an error condition where the invalid URL is returned unescaped. This can lead to JavaScript execution on the Miniflux instance when a user opens the broken image, allowing the attacker to execute arbitrary JavaScript in the context of the victim user and potentially gain administrative access.

Recommendations For Miniflux versions 2.0.25 through 2.0.42, update to version 2.0.43 to resolve the issue. As a temporary workaround, consider disabling the image proxy, with the default value set to http-only.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-27592

GHSA-MQQG-XJHJ-WFGW

Affected Products

Miniflux

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27592.json · Exploit
• https://github.com/miniflux/v2/pull/1746 · Patch
• https://github.com/miniflux/v2/security/advisories/GHSA-mqqg-xjhj-wfgw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27592 · Security Note
• https://osv.dev/vulnerability/CVE-2023-27592 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mqqg-xjhj-wfgw · Vendor Advisory
• https://github.com/miniflux/v2 · Note
• https://github.com/miniflux/v2/blob/b2fd84e0d376a3af6329b9bb2e772ce38a25c31c/ui/proxy.go#L90 · Note
• https://github.com/miniflux/v2/blob/b2fd84e0d376a3af6329b9bb2e772ce38a25c31c/ui/proxy.go#L76 · Note
• https://github.com/miniflux/v2/releases/tag/2.0.43 · Note
• https://github.com/miniflux/v2/releases/tag/2.0.25 · Note
• https://t.me/cibsecurity/60272 · Telegram Post
• https://miniflux.app/docs/configuration.html#proxy-images · Note