rachelos WeRSS We-MP-RSS Server-Side Request Forgery Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in rachelos WeRSS we-mp-rss versions through 1.4.7. The issue arises in the Webhook Module, specifically within the do_job function of the mps.py file. The vulnerability allows authenticated users to manipulate the web_hook_url parameter, leading to unauthorized requests being sent from the server to internal or external resources.

Impact

Exploitation of this vulnerability allows for server-side request forgery, where an authenticated user can make the server send requests to arbitrary URLs. This could potentially be used to access internal services or resources that are not normally exposed to the public.