SourceCodester RSS Feed Parser Server-Side Request Forgery Vulnerability

A blind server-side request forgery (SSRF) vulnerability has been identified in SourceCodester RSS Feed Parser version 1.0. The issue arises because the application fetches user-supplied URLs using the file_get_contents function without proper validation. This flaw allows remote attackers to manipulate the server into making requests to arbitrary destinations, including internal network services and cloud metadata endpoints.

Impact

Exploitation of this vulnerability could enable attackers to interact with internal services, scan internal infrastructure, access internal APIs, or retrieve sensitive information from cloud metadata services.

Reproduction

To reproduce this vulnerability, upload a malicious XML file to a local HTTP server. Then, submit a URL pointing to this file through the RSS feed parser interface. The server will fetch the file, demonstrating the SSRF vulnerability.

Remediation

No specific mitigation measures are known for this vulnerability.