- Yama var
- Son 7 gün
- CWE-918
CVE-2026-55598
PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)
- Yayımlandı
- Güncellendi
- 30 Eki 2026
- Açık yaşı
- 0 gün
- Kaydı açan
- GitHub_M
Özet
Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.
PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through POST /api/data/add_podcast in rust-api/src/handlers/podcasts.rs. get_podcast_values and add_episodes in rust-api/src/database.rs parse the feed with feed-rs and store the <enclosure url> verbatim in Episodes.episodeurl without destination host/IP validation. POST /api/data/download_podcast invokes spawn_download_podcast_episode and download_episode_and_wait() in rust-api/src/services/tasks.rs, which sends a reqwest GET to the stored URL and saves and records the response in DownloadedEpisodes for later retrieval. The estimate_duration_from_audio_url_async() path in rust-api/src/database.rs also sends an unvalidated HEAD during feed add/refresh. Default redirect following permits an initially external enclosure URL to redirect to an internal target. A low-privilege user can make server-side GET/HEAD requests to reachable loopback, private-network and cloud metadata services and read downloaded internal responses, enabling internal-service enumeration, confidential-data disclosure and possible metadata credential theft. Episode downloading requires server downloads to be enabled, which is the default; self-service signup is supported. This issue is fixed in version 0.9.0.
Etkilenen sürümler1 yazılım
| Yazılım | Etkilenen | Düzeltildiği sürüm |
|---|---|---|
| madeofpendletonwool PinePods | < 0.9.0 | 0.9.0 |
Kaynaklar5 kaynak
Kayıt geçmişi
- Yayımlandı