| Package | Affected versions | Patched versions |
|---|---|---|
| contao/contao | ≥ 5.3.35, < 5.3.48≥ 5.4.0, < 5.7.9 | 5.3.485.7.9 |
| contao/core-bundle | ≥ 5.3.35, < 5.3.48≥ 5.4.0, < 5.7.9 | 5.3.485.7.9 |
The Feed Reader front-end module passes RSS feed URLs from its configuration directly to $this->feedIo->read($url) without any scheme validation or private-IP blocklist. A backend user with module-edit permissions can configure an arbitrary URL pointing to internal network services, cloud-provider metadata endpoints, or loopback addresses, causing the server to fetch those resources unconditionally. Confirmed live: the server successfully reaches the internal MySQL database container and its own loopback Apache instance.
In core-bundle/src/Controller/FrontendModule/FeedReaderController.php, the getResponse() function iterates over the configured feed URLs and passes each one directly to the HTTP client with no validation:
// Line 50-55
foreach (StringUtil::trimsplit('[\n\t ]', trim($model->rss_feed)) as $url) {
try {
$feed = $this->cache->get(
'feed_reader_'.$model->id.'_'.md5($url),
function (ItemInterface $item) use ($url, $model) {
$readerResult = $this->feedIo->read($url, new Feed()); // <-- no validation
The DCA field definition for rss_feed in tl_module.php carries no URL scheme or host validation:
'eval' => array('mandatory'=>true, 'decodeEntities'=>true, 'style'=>'height:60px')
The HTTP client is wired as @psr18.http_client (Symfony HttpClient) with no SSRF protection configured (NoPrivateNetworkHttpClient is not used).
This is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
http://169.254.169.254/latest/meta-data/iam/security-credentials/ to obtain IAM role credentials (IMDSv1 has no authentication)Confirmed in live testing: the server successfully connected to the internal MySQL container (172.19.0.3:3306) and retrieved a full HTTP response from its own loopback interface (127.0.0.1:80).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeUse NoPrivateNetworkHttpClient -- wrap the injected HTTP client with Symfony's built-in SSRF protection before passing it to feedIo:
use Symfony\Component\HttpClient\NoPrivateNetworkHttpClient;
$safeClient = new NoPrivateNetworkHttpClient($this->httpClient);
This blocks all RFC-1918, loopback, and link-local addresses at the HTTP client level.
Validate URL scheme and host -- before calling feedIo->read(), parse the URL and reject anything that is not http:// or https:// with a public routable IP or hostname.
Configure the DCA field -- add 'rgxp' => 'url' and a custom validation callback to tl_module.rss_feed to reject non-public URLs at save time.