PT-2024-22142 · Rsshub · Rsshub

Ouuan · Published 2024-03-06 · Updated 2025-12-04 · CVE-2024-27927

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions RSSHub versions prior to 1.0.0-master.a429472

Description The issue allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network or conduct Denial-of-Service (DoS) attacks. This may lead to leaking the server IP address, retrieving information in the internal network, such as accessible addresses and ports, and titles and meta descriptions of HTML pages, and denial of service amplification. The attacker can send malicious requests to a RSSHub server to make the server send HTTP GET requests to arbitrary destinations and see partial responses.

Recommendations For RSSHub versions prior to 1.0.0-master.a429472, update to version 1.0.0-master.a429472 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable API endpoints, such as /mastodon/acct/:acct/statuses/:only media?, /zjol/paper/:id?, and /m4/:id?/:category*, to minimize the risk of exploitation. Avoid using these endpoints until the issue is resolved.

Exploit

Fix

DoS

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-27927

GHSA-3P3P-CGJ7-VGW3

Affected Products

Rsshub

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27927.json · Exploit
• https://github.com/DIYgod/RSSHub/blob/5928c5db2472e101c2f5c3bafed77a2f72edd40a/lib/routes/mastodon/utils.js#L85-L105 · Patch
• https://github.com/DIYgod/RSSHub/blob/172f6cfd2b69ea6affdbdedf61e6dde1671f3796/lib/routes/zjol/paper.js#L7-L13 · Patch
• https://github.com/DIYgod/RSSHub/commit/a42947231104a9ec3436fc52cedb31740c9a7069 · Patch
• https://github.com/DIYgod/RSSHub/blob/5928c5db2472e101c2f5c3bafed77a2f72edd40a/lib/routes/mastodon/acct.js#L4-L7 · Patch
• https://github.com/DIYgod/RSSHub/blob/172f6cfd2b69ea6affdbdedf61e6dde1671f3796/lib/routes/m4/index.js#L10-L14 · Patch
• https://github.com/DIYgod/RSSHub/security/advisories/GHSA-3p3p-cgj7-vgw3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27927 · Security Note
• https://osv.dev/vulnerability/GHSA-3p3p-cgj7-vgw3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27927 · Vendor Advisory
• https://github.com/DIYgod/RSSHub · Note
• https://t.me/cveNotify/144781 · Telegram Post