Omnivore App
Monthly
Authentication bypass in the Omnivore API (packages/api) before commit abf53d6 lets a remote unauthenticated attacker impersonate any Apple-linked account through a JWT algorithm-confusion flaw in Apple sign-in. Because decodeAppleToken trusted the attacker-controlled 'alg' header and jsonwebtoken v8 does not enforce key/algorithm compatibility, an attacker can switch the token to HS256 and sign it with Apple's public RSA key used as the HMAC secret. Reported by VulnCheck; no public exploit identified at time of analysis, though the technique is a well-documented class of attack.
Blind Server-Side Request Forgery in Omnivore's webhook registration flow allows any authenticated user to coerce the application server into issuing repeated HTTP requests to arbitrary internal endpoints, including cloud instance metadata services. The flaw affects all Omnivore API server deployments (CPE: cpe:2.3:a:omnivore-app:omnivore:*:*:*:*:*:*:*:*) and is rooted in setWebhookResolver accepting and persisting caller-supplied URLs with no address validation before callWebhook later executes them via axios. No public exploit identified at time of analysis, and no CISA KEV listing exists; a patch commit is available upstream.
Server-side request forgery in Omnivore's scanFeedsResolver GraphQL endpoint allows authenticated users to direct the API server to fetch arbitrary internal URLs, bypassing the validateUrl() guard consistently applied elsewhere in the same codebase. Reachable internal endpoints return partial feed metadata (URL, title, description, type) and advertised RSS/Atom link elements; unreachable ports are distinguishable through error differentiation, enabling internal network enumeration. No public exploit has been identified and this vulnerability is not listed in CISA KEV; an upstream patch has been merged as commit c4d7d8562.
Authentication bypass in the Omnivore API (packages/api) before commit abf53d6 lets a remote unauthenticated attacker impersonate any Apple-linked account through a JWT algorithm-confusion flaw in Apple sign-in. Because decodeAppleToken trusted the attacker-controlled 'alg' header and jsonwebtoken v8 does not enforce key/algorithm compatibility, an attacker can switch the token to HS256 and sign it with Apple's public RSA key used as the HMAC secret. Reported by VulnCheck; no public exploit identified at time of analysis, though the technique is a well-documented class of attack.
Blind Server-Side Request Forgery in Omnivore's webhook registration flow allows any authenticated user to coerce the application server into issuing repeated HTTP requests to arbitrary internal endpoints, including cloud instance metadata services. The flaw affects all Omnivore API server deployments (CPE: cpe:2.3:a:omnivore-app:omnivore:*:*:*:*:*:*:*:*) and is rooted in setWebhookResolver accepting and persisting caller-supplied URLs with no address validation before callWebhook later executes them via axios. No public exploit identified at time of analysis, and no CISA KEV listing exists; a patch commit is available upstream.
Server-side request forgery in Omnivore's scanFeedsResolver GraphQL endpoint allows authenticated users to direct the API server to fetch arbitrary internal URLs, bypassing the validateUrl() guard consistently applied elsewhere in the same codebase. Reachable internal endpoints return partial feed metadata (URL, title, description, type) and advertised RSS/Atom link elements; unreachable ports are distinguishable through error differentiation, enabling internal network enumeration. No public exploit has been identified and this vulnerability is not listed in CISA KEV; an upstream patch has been merged as commit c4d7d8562.