GHSA-87mg-5grr-rhwhlow3.1

Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

The advisory, in context

Summary

The Feed Reader front-end module passes RSS feed URLs from its configuration directly to $this->feedIo->read($url) without any scheme validation or private-IP blocklist. A backend user with module-edit permissions can configure an arbitrary URL pointing to internal network services, cloud-provider metadata endpoints, or loopback addresses, causing the server to fetch those resources unconditionally. Confirmed live: the server successfully reaches the internal MySQL database container and its own loopback Apache instance.

Details

In core-bundle/src/Controller/FrontendModule/FeedReaderController.php, the getResponse() function iterates over the configured feed URLs and passes each one directly to the HTTP client with no validation:

// Line 50-55
foreach (StringUtil::trimsplit('[\n\t ]', trim($model->rss_feed)) as $url) {
    try {
        $feed = $this->cache->get(
            'feed_reader_'.$model->id.'_'.md5($url),
            function (ItemInterface $item) use ($url, $model) {
                $readerResult = $this->feedIo->read($url, new Feed()); // <-- no validation

The DCA field definition for rss_feed in tl_module.php carries no URL scheme or host validation:

'eval' => array('mandatory'=>true, 'decodeEntities'=>true, 'style'=>'height:60px')

The HTTP client is wired as @psr18.http_client (Symfony HttpClient) with no SSRF protection configured (NoPrivateNetworkHttpClient is not used).

Impact

This is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:

Enumerate internal network services -- probe any IP/port on the internal network by observing response times and error messages
Reach internal APIs -- access unauthenticated services inside the Docker/Kubernetes network (databases, caches, admin panels)
Steal cloud metadata credentials -- on AWS, fetch http://169.254.169.254/latest/meta-data/iam/security-credentials/ to obtain IAM role credentials (IMDSv1 has no authentication)
Pivot to internal infrastructure -- use the server as a proxy to interact with services not exposed to the public internet

Confirmed in live testing: the server successfully connected to the internal MySQL container (172.19.0.3:3306) and retrieved a full HTTP response from its own loopback interface (127.0.0.1:80).

Remediation

Use NoPrivateNetworkHttpClient -- wrap the injected HTTP client with Symfony's built-in SSRF protection before passing it to feedIo:
```
use Symfony\Component\HttpClient\NoPrivateNetworkHttpClient;

$safeClient = new NoPrivateNetworkHttpClient($this->httpClient);
```
This blocks all RFC-1918, loopback, and link-local addresses at the HTTP client level.
Validate URL scheme and host -- before calling feedIo->read(), parse the URL and reject anything that is not http:// or https:// with a public routable IP or hostname.
Configure the DCA field -- add 'rgxp' => 'url' and a custom validation callback to tl_module.rss_feed to reject non-public URLs at save time.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

contao/contao Packagist

Ecosystem versions

From 5.3.35 before 5.3.48

Fixed in 5.3.48

13 explicitly affected versions

5.3.35, 5.3.36, 5.3.37, 5.3.38, 5.3.39, 5.3.40, 5.3.41, 5.3.42, 5.3.43, 5.3.44, 5.3.45, 5.3.46, 5.3.47

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "5.3.35"
        },
        {
          "fixed": "5.3.48"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "5.3.35",
    "5.3.36",
    "5.3.37",
    "5.3.38",
    "5.3.39",
    "5.3.40",
    "5.3.41",
    "5.3.42",
    "5.3.43",
    "5.3.44",
    "5.3.45",
    "5.3.46",
    "5.3.47"
  ]
}

contao/contao Packagist

Ecosystem versions

From 5.4.0 before 5.7.9

Fixed in 5.7.9

64 explicitly affected versions

5.4.0, 5.4.1, 5.4.10, 5.4.11, 5.4.12, 5.4.13, 5.4.14, 5.4.2, 5.4.3, 5.4.4, 5.4.5, 5.4.6, 5.4.7, 5.4.8, 5.4.9, 5.5.0, 5.5.0-RC1, 5.5.0-RC2, 5.5.0-RC3, 5.5.0-RC4, 5.5.1, 5.5.10, 5.5.11, 5.5.12, 5.5.13, 5.5.14, 5.5.15, 5.5.16, 5.5.2, 5.5.3, 5.5.4, 5.5.5, 5.5.6, 5.5.7, 5.5.8, 5.5.9, 5.6.0, 5.6.0-RC1, 5.6.0-RC2, 5.6.0-RC3, 5.6.1, 5.6.10, 5.6.11, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.7.0, 5.7.0-RC1, 5.7.0-RC2, 5.7.0-RC3, 5.7.0-RC4, 5.7.1, 5.7.2, 5.7.3, 5.7.4, 5.7.5, 5.7.6, 5.7.7, 5.7.8

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "5.4.0"
        },
        {
          "fixed": "5.7.9"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "5.4.0",
    "5.4.1",
    "5.4.10",
    "5.4.11",
    "5.4.12",
    "5.4.13",
    "5.4.14",
    "5.4.2",
    "5.4.3",
    "5.4.4",
    "5.4.5",
    "5.4.6",
    "5.4.7",
    "5.4.8",
    "5.4.9",
    "5.5.0",
    "5.5.0-RC1",
    "5.5.0-RC2",
    "5.5.0-RC3",
    "5.5.0-RC4",
    "5.5.1",
    "5.5.10",
    "5.5.11",
    "5.5.12",
    "5.5.13",
    "5.5.14",
    "5.5.15",
    "5.5.16",
    "5.5.2",
    "5.5.3",
    "5.5.4",
    "5.5.5",
    "5.5.6",
    "5.5.7",
    "5.5.8",
    "5.5.9",
    "5.6.0",
    "5.6.0-RC1",
    "5.6.0-RC2",
    "5.6.0-RC3",
    "5.6.1",
    "5.6.10",
    "5.6.11",
    "5.6.2",
    "5.6.3",
    "5.6.4",
    "5.6.5",
    "5.6.6",
    "5.6.7",
    "5.6.8",
    "5.6.9",
    "5.7.0",
    "5.7.0-RC1",
    "5.7.0-RC2",
    "5.7.0-RC3",
    "5.7.0-RC4",
    "5.7.1",
    "5.7.2",
    "5.7.3",
    "5.7.4",
    "5.7.5",
    "5.7.6",
    "5.7.7",
    "5.7.8"
  ]
}

contao/core-bundle Packagist

Ecosystem versions

From 5.3.35 before 5.3.48

Fixed in 5.3.48

13 explicitly affected versions

5.3.35, 5.3.36, 5.3.37, 5.3.38, 5.3.39, 5.3.40, 5.3.41, 5.3.42, 5.3.43, 5.3.44, 5.3.45, 5.3.46, 5.3.47

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "5.3.35"
        },
        {
          "fixed": "5.3.48"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "5.3.35",
    "5.3.36",
    "5.3.37",
    "5.3.38",
    "5.3.39",
    "5.3.40",
    "5.3.41",
    "5.3.42",
    "5.3.43",
    "5.3.44",
    "5.3.45",
    "5.3.46",
    "5.3.47"
  ]
}

contao/core-bundle Packagist

Ecosystem versions

From 5.4.0 before 5.7.9

Fixed in 5.7.9

64 explicitly affected versions

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "5.4.0"
        },
        {
          "fixed": "5.7.9"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "5.4.0",
    "5.4.1",
    "5.4.10",
    "5.4.11",
    "5.4.12",
    "5.4.13",
    "5.4.14",
    "5.4.2",
    "5.4.3",
    "5.4.4",
    "5.4.5",
    "5.4.6",
    "5.4.7",
    "5.4.8",
    "5.4.9",
    "5.5.0",
    "5.5.0-RC1",
    "5.5.0-RC2",
    "5.5.0-RC3",
    "5.5.0-RC4",
    "5.5.1",
    "5.5.10",
    "5.5.11",
    "5.5.12",
    "5.5.13",
    "5.5.14",
    "5.5.15",
    "5.5.16",
    "5.5.2",
    "5.5.3",
    "5.5.4",
    "5.5.5",
    "5.5.6",
    "5.5.7",
    "5.5.8",
    "5.5.9",
    "5.6.0",
    "5.6.0-RC1",
    "5.6.0-RC2",
    "5.6.0-RC3",
    "5.6.1",
    "5.6.10",
    "5.6.11",
    "5.6.2",
    "5.6.3",
    "5.6.4",
    "5.6.5",
    "5.6.6",
    "5.6.7",
    "5.6.8",
    "5.6.9",
    "5.7.0",
    "5.7.0-RC1",
    "5.7.0-RC2",
    "5.7.0-RC3",
    "5.7.0-RC4",
    "5.7.1",
    "5.7.2",
    "5.7.3",
    "5.7.4",
    "5.7.5",
    "5.7.6",
    "5.7.7",
    "5.7.8"
  ]
}

Set up in your agent.

Investigate in your agent.

Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

The advisory, in context

Summary

Details

Impact

Remediation

Affected packages

References