CVE-2023-22493 - Vulnerability Details - OpenCVE

RSSHub is an open source RSS feed generator. RSSHub is vulnerable to Server-Side Request Forgery (SSRF) attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers or resources on the network. An attacker can exploit this vulnerability by sending a request to the affected routes with a malicious URL. An attacker could also use this vulnerability to send requests to internal or any other servers or resources on the network, potentially gain access to sensitive information that would not normally be accessible and amplifying the impact of the attack. The patch for this issue can be found in commit a66cbcf.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Rsshub	Rsshub

Configuration 1 [-]

cpe:2.3:a:rsshub:rsshub:*:*:*:*:*:node.js:*:*

No data.

References

Link	Providers
https://github.com/DIYgod/RSSHub/commit/a66cbcf6eebc700bf97ab097f404f16ab415506a
https://github.com/DIYgod/RSSHub/pull/11588
https://github.com/DIYgod/RSSHub/security/advisories/GHSA-64wp-jh9p-5cg2

History

Mon, 10 Mar 2025 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-01-13T14:28:49.464Z

Updated: 2025-03-10T21:30:18.414Z

Reserved: 2022-12-29T17:41:28.089Z

Link: CVE-2023-22493

Vulnrichment

Updated: 2024-08-02T10:13:48.660Z

NVD

Status : Modified

Published: 2023-01-13T15:15:09.233

Modified: 2024-11-21T07:44:55.237

Link: CVE-2023-22493

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-22493", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2022-12-29T17:41:28.089Z", "datePublished": "2023-01-13T14:28:49.464Z", "dateUpdated": "2025-03-10T21:30:18.414Z"}, "containers": {"cna": {"title": "RSSHub is vulnerable to SSRF (Server-Side Request Forgery)", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/DIYgod/RSSHub/security/advisories/GHSA-64wp-jh9p-5cg2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/DIYgod/RSSHub/security/advisories/GHSA-64wp-jh9p-5cg2"}, {"name": "https://github.com/DIYgod/RSSHub/pull/11588", "tags": ["x_refsource_MISC"], "url": "https://github.com/DIYgod/RSSHub/pull/11588"}, {"name": "https://github.com/DIYgod/RSSHub/commit/a66cbcf6eebc700bf97ab097f404f16ab415506a", "tags": ["x_refsource_MISC"], "url": "https://github.com/DIYgod/RSSHub/commit/a66cbcf6eebc700bf97ab097f404f16ab415506a"}], "affected": [{"vendor": "DIYgod", "product": "RSSHub", "versions": [{"version": "< 1.0.0-master.a66cbcf", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-01-13T14:28:49.464Z"}, "descriptions": [{"lang": "en", "value": "RSSHub is an open source RSS feed generator. RSSHub is vulnerable to Server-Side Request Forgery (SSRF) attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers or resources on the network. An attacker can exploit this vulnerability by sending a request to the affected routes with a malicious URL. An attacker could also use this vulnerability to send requests to internal or any other servers or resources on the network, potentially gain access to sensitive information that would not normally be accessible and amplifying the impact of the attack. The patch for this issue can be found in commit a66cbcf. "}], "source": {"advisory": "GHSA-64wp-jh9p-5cg2", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:13:48.660Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/DIYgod/RSSHub/security/advisories/GHSA-64wp-jh9p-5cg2", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/DIYgod/RSSHub/security/advisories/GHSA-64wp-jh9p-5cg2"}, {"name": "https://github.com/DIYgod/RSSHub/pull/11588", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/DIYgod/RSSHub/pull/11588"}, {"name": "https://github.com/DIYgod/RSSHub/commit/a66cbcf6eebc700bf97ab097f404f16ab415506a", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/DIYgod/RSSHub/commit/a66cbcf6eebc700bf97ab097f404f16ab415506a"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-10T21:01:38.721127Z", "id": "CVE-2023-22493", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-10T21:30:18.414Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/DIYgod/RSSHub/security/advisories/GHSA-64wp-jh9p-5cg2", "name": "https://github.com/DIYgod/RSSHub/security/advisories/GHSA-64wp-jh9p-5cg2", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/DIYgod/RSSHub/pull/11588", "name": "https://github.com/DIYgod/RSSHub/pull/11588", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/DIYgod/RSSHub/commit/a66cbcf6eebc700bf97ab097f404f16ab415506a", "name": "https://github.com/DIYgod/RSSHub/commit/a66cbcf6eebc700bf97ab097f404f16ab415506a", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:13:48.660Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-22493", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-10T21:01:38.721127Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-10T21:01:40.100Z"}}], "cna": {"title": "RSSHub is vulnerable to SSRF (Server-Side Request Forgery)", "source": {"advisory": "GHSA-64wp-jh9p-5cg2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "DIYgod", "product": "RSSHub", "versions": [{"status": "affected", "version": "< 1.0.0-master.a66cbcf"}]}], "references": [{"url": "https://github.com/DIYgod/RSSHub/security/advisories/GHSA-64wp-jh9p-5cg2", "name": "https://github.com/DIYgod/RSSHub/security/advisories/GHSA-64wp-jh9p-5cg2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/DIYgod/RSSHub/pull/11588", "name": "https://github.com/DIYgod/RSSHub/pull/11588", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/DIYgod/RSSHub/commit/a66cbcf6eebc700bf97ab097f404f16ab415506a", "name": "https://github.com/DIYgod/RSSHub/commit/a66cbcf6eebc700bf97ab097f404f16ab415506a", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "RSSHub is an open source RSS feed generator. RSSHub is vulnerable to Server-Side Request Forgery (SSRF) attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers or resources on the network. An attacker can exploit this vulnerability by sending a request to the affected routes with a malicious URL. An attacker could also use this vulnerability to send requests to internal or any other servers or resources on the network, potentially gain access to sensitive information that would not normally be accessible and amplifying the impact of the attack. The patch for this issue can be found in commit a66cbcf. "}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-01-13T14:28:49.464Z"}}}, "cveMetadata": {"cveId": "CVE-2023-22493", "state": "PUBLISHED", "dateUpdated": "2025-03-10T21:30:18.414Z", "dateReserved": "2022-12-29T17:41:28.089Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-01-13T14:28:49.464Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rsshub:rsshub:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "18B342A9-E532-438B-AEE5-55A03BB5D7A5", "versionEndExcluding": "2023-01-10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "RSSHub is an open source RSS feed generator. RSSHub is vulnerable to Server-Side Request Forgery (SSRF) attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers or resources on the network. An attacker can exploit this vulnerability by sending a request to the affected routes with a malicious URL. An attacker could also use this vulnerability to send requests to internal or any other servers or resources on the network, potentially gain access to sensitive information that would not normally be accessible and amplifying the impact of the attack. The patch for this issue can be found in commit a66cbcf. "}, {"lang": "es", "value": "RSSHub es un generador de fuentes RSS de c\u00f3digo abierto. RSSHub es vulnerable a ataques de Server-Side Request Forgery (SSRF). Esta vulnerabilidad permite a un atacante enviar solicitudes HTTP arbitrarias desde el servidor a otros servidores o recursos de la red. Un atacante puede aprovechar esta vulnerabilidad enviando una solicitud a las rutas afectadas con una URL maliciosa. Un atacante tambi\u00e9n podr\u00eda utilizar esta vulnerabilidad para enviar solicitudes a servidores o recursos internos o de otro tipo en la red, potencialmente obtener acceso a informaci\u00f3n confidencial a la que normalmente no ser\u00eda accesible y amplificar el impacto del ataque. El parche para este problema se puede encontrar en el commit a66cbcf."}], "id": "CVE-2023-22493", "lastModified": "2024-11-21T07:44:55.237", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.3, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-01-13T15:15:09.233", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/DIYgod/RSSHub/commit/a66cbcf6eebc700bf97ab097f404f16ab415506a"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/DIYgod/RSSHub/pull/11588"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/DIYgod/RSSHub/security/advisories/GHSA-64wp-jh9p-5cg2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/DIYgod/RSSHub/commit/a66cbcf6eebc700bf97ab097f404f16ab415506a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/DIYgod/RSSHub/pull/11588"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/DIYgod/RSSHub/security/advisories/GHSA-64wp-jh9p-5cg2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}