PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)

Overview

PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through POST /api/data/add_podcast in rust-api/src/handlers/podcasts.rs. get_podcast_values and add_episodes in rust-api/src/database.rs parse the feed with feed-rs and store the <enclosure url> verbatim in Episodes.episodeurl without destination host/IP validation. POST /api/data/download_podcast invokes spawn_download_podcast_episode and download_episode_and_wait() in rust-api/src/services/tasks.rs, which sends a reqwest GET to the stored URL and saves and records the response in DownloadedEpisodes for later retrieval. The estimate_duration_from_audio_url_async() path in rust-api/src/database.rs also sends an unvalidated HEAD during feed add/refresh. Default redirect following permits an initially external enclosure URL to redirect to an internal target. A low-privilege user can make server-side GET/HEAD requests to reachable loopback, private-network and cloud metadata services and read downloaded internal responses, enabling internal-service enumeration, confidential-data disclosure and possible metadata credential theft. Episode downloading requires server downloads to be enabled, which is the default; self-service signup is supported. This issue is fixed in version 0.9.0.

Affected

• PinePods < 0.9.0

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.