Authenticated SSRF in Omnom via Arbitrary Feed URL Submission

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the omnom application up to version 0.9.0. Authenticated users can submit feed URLs via the /add_feed route to make the server request arbitrary hosts. The server functions getFeedInfo, gofeed ParseURL, and fetchImageAsInlineURL do not validate these URLs, allowing attackers to probe internal hosts and ports using reflected error messages.

Useful 0 Not Useful 0

Detection Guidance

To detect this SSRF vulnerability in omnom through 0.9.0, monitor outbound HTTP requests from the omnom service to internal or unexpected hosts. Check logs for feed URL processing failures or repeated requests to private IPs like 169.254.169.254. Use network tools like tcpdump or Wireshark to inspect traffic from the omnom process.

Useful 0 Not Useful 0

Impact Analysis

An attacker with authenticated access could exploit this to scan internal networks, access sensitive internal services, or exfiltrate data by forcing the server to make requests to restricted endpoints. The vulnerability also allows repeated probing due to hourly feed updates fetching embedded images, prolonging exposure.

Useful 0 Not Useful 0

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to internal systems, potentially exposing personal or sensitive data. This may violate GDPR's data protection principles and HIPAA's security requirements for safeguarding protected health information, depending on the data processed by the omnom service.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade omnom to a version beyond 0.9.0 where the fix is applied. Alternatively, apply the commit 01c4551 changes manually by restricting outbound requests to public destinations only and configuring allowed private exceptions in the outbound.allowed_private_destinations setting.

Useful 0 Not Useful 0