Tiny Tiny RSS Vulnerability Analysis: XSS, SSRF, LFI (CVE-2020-25787/25788/25789)

Key Vulnerability Information Summary 1. Application Context - Target Application: Tiny Tiny RSS (2020 version) - Objective: Identify and exploit security vulnerabilities --- 2. Main Vulnerabilities Found - Unauthenticated Subscription/Logout - Exploitation Point: Unprotected and functions. - Exploitation Method: Sending GET requests. - - - XSS Vulnerability - Exploitation Point: Security flaw in the plugin when handling tags. - Exploitation Method: Crafting an XSS payload within an image link and injecting it into an RSS subscription. - CVE ID: CVE-2020-25787 - SSRF (Server-Side Request Forgery) - Exploitation Point: Lack of mandatory MIME type enforcement and absence of internal address filtering. - Exploitation Method: Exploiting the plugin to send requests targeting internal services or files. - LFI (Local File Inclusion) - Exploitation Point: plugin does not properly filter the protocol. - Exploitation Method: Reading arbitrary files via the protocol. - Example: --- 3. Exploitation Process and Tools - Vulnerability Environment Testing: Tested by deploying the latest version of Tiny Tiny RSS. - Exploitation Tools: - gopherus - Used to generate gopher links, facilitating attacks on SSRF and RCE scenarios. - Exploit-DB - Repository for exploit scripts. --- 4. Impact and Mitigation Recommendations - CVE IDs - CVE-2020-25787 - XSS vulnerability. - CVE-2020-25788 - Server-Side Request Forgery vulnerability. - CVE-2020-25789 - LFI vulnerability. - Mitigation Recommendations: - Upgrade Tiny Tiny RSS to the latest version. - Disable or remove unnecessary plugins (e.g., ). - Ensure the latest version of the cURL library is in use.

Goal Reached Thanks to every supporter — we hit 100%!

Tiny Tiny RSS Vulnerability Analysis: XSS, SSRF, LFI (CVE-2020-25787/25788/25789)