Headline
CVE-2023-27592: Release Miniflux 2.0.43 · miniflux/v2
Miniflux is a feed reader. Since v2.0.25, Miniflux will automatically proxy images served over HTTP to prevent mixed content errors. When an outbound request made by the Go HTTP client fails, the html.ServerError is returned unescaped without the expected Content Security Policy header added to valid responses. By creating an RSS feed item with the inline description containing an <img> tag with a srcset attribute pointing to an invalid URL like http:a<script>alert(1)</script>, we can coerce the proxy handler into an error condition where the invalid URL is returned unescaped and in full. This results in JavaScript execution on the Miniflux instance as soon as the user is convinced (e.g. by a message in the alt text) to open the broken image. An attacker can execute arbitrary JavaScript in the context of a victim Miniflux user when they open a broken image in a crafted RSS feed. This can be used to perform actions on the Miniflux instance as that user and gain administrative access to the Miniflux instance if it is reachable and the victim is an administrator. A patch is available in version 2.0.43. As a workaround sisable image proxy; default value is http-only.
Avoid XSS when opening a broken image due to unescaped ServerError in proxy handler (CVE-2023-27592)
Creating an RSS feed item with the inline description containing an <img> tag
with a srcset attribute pointing to an invalid URL like
http:a<script>alert(1)</script>, we can coerce the proxy handler into an error
condition where the invalid URL is returned unescaped and in full.This results in JavaScript execution on the Miniflux instance as soon as the
user is convinced to open the broken image.Use r.RemoteAddr to check /metrics endpoint network access (CVE-2023-27591)
HTTP headers like X-Forwarded-For or X-Real-Ip can be easily spoofed. As
such, it cannot be used to test if the client IP is allowed.The recommendation is to use HTTP Basic authentication to protect the
metrics endpoint, or run Miniflux behind a trusted reverse-proxy.Add HTTP Basic authentication for /metrics endpoint
Add proxy support for several media types
Parse feed categories from RSS, Atom and JSON feeds
Ignore empty link when discovering feeds
Disable CGO explicitly to make sure the binary is statically linked
Add CSS classes to differentiate between category/feed/entry view and icons
Add rewrite and scraper rules for blog.cloudflare.com
Add color-scheme to themes
Add new keyboard shortcut to toggle open/close entry attachments section
Sanitizer: allow id attribute in <sup> element
Add Indonesian Language
Update translations
Update Docker Compose examples:
- Run the application in one command
- Bring back the health check condition to depends_on
- Remove deprecated version element
Update scraping rules for ilpost.it
Bump github.com/PuerkitoBio/goquery from 1.8.0 to 1.8.1
Bump github.com/tdewolff/minify/v2 from 2.12.4 to 2.12.5
Bump github.com/yuin/goldmark from 1.5.3 to 1.5.4
Bump golang.org/x/* dependencies
Related news
Miniflux is a feed reader. Prior to version 2.0.43, an unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the `METRICS_COLLECTOR` configuration option is enabled and `METRICS_ALLOWED_NETWORKS` is set to `127.0.0.1/8` (the default). A patch is available in Miniflux 2.0.43. As a workaround, set `METRICS_COLLECTOR` to `false` (default) or run Miniflux behind a trusted reverse-proxy.