Stringer
Monthly
Server-side request forgery in Stringer, a self-hosted RSS reader, allows an authenticated low-privileged user to make the server issue arbitrary HTTP/HTTPS requests to internal network hosts, loopback services, and cloud metadata endpoints such as AWS IMDS at 169.254.169.254. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, base 7.6) confirms a network-reachable, low-complexity attack requiring only an authenticated account - a barrier that collapses to near-anonymous when self-service signup (Setting::UserSignup) is enabled, since any visitor can register. Impact ranges from internal port and service scanning to theft of cloud IAM credentials when Stringer runs on a cloud instance with an attached role reachable via IMDSv1; there is no public exploit identified at time of analysis and no confirmed CISA KEV active exploitation, though the attack surface is trivial to exercise for anyone holding a valid session.
Server-side request forgery in Stringer, a self-hosted RSS reader, allows an authenticated low-privileged user to make the server issue arbitrary HTTP/HTTPS requests to internal network hosts, loopback services, and cloud metadata endpoints such as AWS IMDS at 169.254.169.254. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, base 7.6) confirms a network-reachable, low-complexity attack requiring only an authenticated account - a barrier that collapses to near-anonymous when self-service signup (Setting::UserSignup) is enabled, since any visitor can register. Impact ranges from internal port and service scanning to theft of cloud IAM credentials when Stringer runs on a cloud instance with an attached role reachable via IMDSv1; there is no public exploit identified at time of analysis and no confirmed CISA KEV active exploitation, though the attack surface is trivial to exercise for anyone holding a valid session.