Tiny Tiny RSS (TT-RSS) developers act promptly to resolve Big Big security problems

guest · Sep 27, 2020

Tiny Tiny RSS developers act promptly to resolve Big Big security problems
Security researchers praise project maintainers for fixing RCE bug that could have been exploited at scale
September 24, 2020
https://portswigger.net/daily-swig/...promptly-to-resolve-big-big-security-problems

Vulnerabilities in the popular Tiny Tiny RSS (TT-RSS) feed reader that posed a remote code execution risk and might have being exploited at scale have been resolved.

A series of problems in TT-RSS were discovered after a systematic evaluation by security researchers Daniel Neagaru and Benjamin Nadarević at security start-up DigeeX.
Andrew Dolgov, TT-RSS’ main developer, acted promptly to triage and resolve all the issues reported, allowing the researchers to go public with a detailed write-up of their findings this week.

“We do not know how other RSS readers compare to TT-RSS, but we know the developer has fixed all of our findings and more, and it’s moving the project into the right direction,” Neagaru told The Daily Swig.
Click to expand...

The impact of the resolved vulnerabilities is severe because it might have been abused to infect TT-RSS servers en mass without targeting each user individually, Neagaru explained.

“To exploit the remote code execution flaw, an attacker needs to have access to a popular feed, either his own, or from a compromised website,” Neagaru said.
Click to expand...

Tiny Tiny RSS is a free and open source web-based RSS and Atom feed reader and aggregator. The technology works as a server-side AJAX-powered application.
Click to expand...

DigeeX: Exploiting Tiny Tiny RSS

Conclusion
The default docker installation of tt-rss has a vulnerability that allows for remote code execution. It can be mass-exploited through a popular subscription feed.

Manually installed instances are also vulnerable if PHP-FPM is running on port 9000 (instead of Unix socket), and cURL version is below 7.71.1. Remote code execution might be possible even if those conditions are not satisfied, but we have not researched how.
Even if remote code execution cannot be achieved, attackers can get contents of internal files and portscan internal services if the user clicks the article title. All instances are vulnerable to this, docker or otherwise.
Click to expand...

Log in or Sign up

Tiny Tiny RSS (TT-RSS) developers act promptly to resolve Big Big security problems

guest Guest

Log in or Sign up

Tiny Tiny RSS (TT-RSS) developers act promptly to resolve Big Big security problems

guest Guest

Useful Searches