CVE-2024-27927 json
RSSHub vulnerable to SSRF in /mastodon, /zjoi, and /m4
published 2024-03-06 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-0804 , GHSA-3p3p-cgj7-vgw3
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 64%
- public exploits
- 0
- none known
Summary
RSSHub is an open source RSS feed generator. Prior to version 1.0.0-master.a429472, RSSHub allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network or conduct Denial-of-Service (DoS) attacks. The attacker can send malicious requests to a RSSHub server, to make the server send HTTP GET requests to arbitrary destinations and see partial responses. This may lead to leak the server IP address, which could be hidden behind a CDN; retrieving information in the internal network, e.g. which addresses/ports are accessible, the titles and meta descriptions of HTML pages; and denial of service amplification. The attacker could request the server to download some large files, or chain several SSRF requests in a single attacker request.
Patch / fix
- npm rsshub 1.0.0-master.a429472
- rsshub rsshub 1.0.0-master.a429472
- github.com/DIYgod/RSSHub@a429472 commit
- github.com/DIYgod/RSSHub/blob/172f6cfd2b69ea6affdbdedf61e6dde1671f379… patch
- github.com/DIYgod/RSSHub/blob/172f6cfd2b69ea6affdbdedf61e6dde1671f379… patch
- github.com/DIYgod/RSSHub/blob/5928c5db2472e101c2f5c3bafed77a2f72edd40… patch
- github.com/DIYgod/RSSHub/blob/5928c5db2472e101c2f5c3bafed77a2f72edd40… patch
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
1.04% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/DIYgod/RSSHub/security/advisories/GHSA-3p3p-cgj7-vgw3 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | rsshub | <1.0.0-master.a429472 |
1.0.0-master.a429472 |
Affected products
- DIYgod RSSHub
- rsshub rsshub
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/DIYgod/RSSHub/commit/a42947231104a9ec3436fc52cedb31740c9a7069
web, patch
-
github.com
/DIYgod/RSSHub/blob/172f6cfd2b69ea6affdbdedf61e6dde1671f3796/lib/routes/m4/index.js#L10-L14
web, patch
-
github.com
/DIYgod/RSSHub/blob/172f6cfd2b69ea6affdbdedf61e6dde1671f3796/lib/routes/zjol/paper.js#L7-L13
web, patch
-
github.com
/DIYgod/RSSHub/blob/5928c5db2472e101c2f5c3bafed77a2f72edd40a/lib/routes/mastodon/acct.js#L4-L7
web, patch
-
github.com
/DIYgod/RSSHub/blob/5928c5db2472e101c2f5c3bafed77a2f72edd40a/lib/routes/mastodon/utils.js#L85-L105
web, patch
-
github.com
/DIYgod/RSSHub/security/advisories/GHSA-3p3p-cgj7-vgw3
web, exploit, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-27927
advisory
-
github.com
/DIYgod/RSSHub
package
Sources
- CVE List CVE-2024-27927
- GitHub Advisory GHSA-3p3p-cgj7-vgw3
- NVD CVE-2024-27927
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.