CVE-2024-27927: 
JavaScript vulnerability analysis and mitigation

RSSHub, an open source RSS feed generator, was found to contain multiple Server-Side Request Forgery (SSRF) vulnerabilities prior to version 1.0.0-master.a429472. The vulnerability allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information from the internal network or conduct Denial-of-Service (DoS) attacks (GitHub Advisory).

The vulnerability affects multiple endpoints including /mastodon/acct/:acct/statuses/:only_media?, /zjol/paper/:id?, and /m4/:id?/:category*. Attackers can send malicious requests to make the RSSHub server send HTTP GET requests to arbitrary destinations and view partial responses. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L (GitHub Advisory).

The vulnerability can lead to several impacts: leaking the server IP address that may be hidden behind a CDN, retrieving information from the internal network including accessible addresses/ports and HTML page metadata, and enabling DoS amplification attacks through large file downloads or chained SSRF requests (GitHub Advisory).

The vulnerability can be exploited by sending specially crafted requests to affected RSSHub endpoints. No authentication is required, and proof-of-concept examples have been documented targeting the /mastodon/acct, /zjol/paper, and /m4 endpoints (GitHub Advisory).

The vulnerability has been patched in version 1.0.0-master.a429472. Users should upgrade to this version or later to address the SSRF vulnerabilities (GitHub Advisory).