FreshRSS vulnerabilities

FreshRSS, a free self-hostable RSS aggregator, contains a vulnerability in development versions (from 57e1a37 to 00f2f04) where the nonce length was changed from 40 to 64 characters. password_verify() is called with a constructed string (SHA-256 nonce + part of a bcrypt hash) instead of the raw user password. Due to bcrypt's 72-byte input truncation, password verification may succeed even when the user enters an incorrect password.

FreshRSS prior to version 1.28.0 uses cryptographically weak random number generators (mt_rand() and uniqid()) to generate remember-me authentication tokens and challenge-response nonces. This allows attackers to predict valid session tokens, leading to account takeover through persistent session hijacking.

FreshRSS versions 1.16.0 through 1.26.3 allow an unprivileged attacker to create an admin user when registration is enabled, by abusing the hidden new_user_is_admin field used only in the admin user management page. This is fixed in version 1.27.0.

FreshRSS versions 1.26.3 and below do not properly terminate the session during logout. After logout, the session cookie remains active and unchanged, which can lead to session hijacking and fixation vulnerabilities. This is fixed in version 1.27.0.

FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, an attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on a given instance, making it unusable for the majority of users. This issue has been patched in version 1.28.0.

FreshRSS is a free, self-hostable RSS aggregator. Versions prior to 1.27.1 have a logout cross-site request forgery vulnerability that can lead to denial of service via <track src>. Version 1.27.1 patches the issue.

FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the `language` user configuration parameter, it's possible to call `install.php` and perform various administrative actions as an unprivileged user. These actions include logging in as the admin, creating a new admin user, or set the database to an attacker-controlled MySQL server and abuse it to execute code in FreshRSS by setting malicious feed `curl_params` inside the `feed` table. Version 1.27.1 fixes the issue.

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below are vulnerable to directory enumeration by setting a path in the theme field, allowing attackers to gain additional information about the server.

FreshRSS versions 1.26.3 and below have a bypass of double clickjacking protection, allowing an attacker to trick the admin into clicking the Promote button on another user's management page after the admin double-clicks a button on an attacker-controlled website.

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not sanitize certain event handler attributes in feed content, allowing XSS payload execution if a page renders feed entries without CSP. The Allow API access setting must be enabled beforehand. Account takeover is possible via password change, UserJS persistence, autofill password theft, or phishing page display. If the victim is an administrator, the attacker can perform administrative actions. Fixed in 1.27.0.

FreshRSS versions 1.26.3 and below contain a vulnerability where a specially crafted page can trick a user into executing arbitrary JS code or promoting a user in FreshRSS by obscuring UI elements in iframes. If embedding an authenticated iframe is possible, this may lead to privilege escalation via obscuring the promote user button in the admin UI or XSS by tricking the user to drag content into the UserJS text area. This is fixed in version 1.27.0.

FreshRSS versions 1.26.3 and below expose information about feeds and tags of default admin users, due to lack of access checking in the FreshRSS_Auth::hasAccess() function used by some of the tag/feed related endpoints. FreshRSS controllers usually have a defined firstAction() method with an override to make sure that every action requires access. If one doesn't, then every action has to check for access manually, and certain endpoints use neither the firstAction() method, or do they perform a manual access check. This issue is fixed in version 1.27.0.