Nextcloud News Blind Server-Side Request Forgery Vulnerability

A blind server-side request forgery (SSRF) vulnerability has been identified in Nextcloud News versions prior to 28.3.0-beta.1. This vulnerability allows authenticated users to add feeds by providing a feed URL through the web interface or API. An authenticated attacker could exploit this by directing the Nextcloud server to make HTTP requests to internal or private IP addresses, including localhost. While the results of these requests are not relayed back to the attacker, this vulnerability could be used to scan or probe internal network services accessible from the Nextcloud server.

Impact

Exploitation of this vulnerability could allow an authenticated attacker to perform blind SSRF, probing internal network services from the perspective of the Nextcloud server.

Remediation

Users can upgrade to Nextcloud News version 28.3.0-beta.1 or later to address this vulnerability.