Description
rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offset ignores the only_publish flag, attackers can enumerate feed IDs and offsets to retrieve private feed stories.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
anyant rssant
Default version status: unaffected
1.9.0 to ≤ 1.9.1affected
References
- https://github.com/anyant/rssant/issues/155 ↗
- https://github.com/anyant/rssant ↗
- https://github.com/anyant/rssant/commit/b65336f1414a32a50670ee2ba7e87cb38e0ad47b ↗
- https://github.com/anyant/rssant/blob/v1.9.1/rssant_api/models/union_story.py#L197-L200 ↗
- https://www.vulncheck.com/advisories/rssant-1.9.0-through-1.9.1-information-disclosure-via-publish-story-get-endpoint ↗