CVE-2023-27591: Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics
Impact
An unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the METRICSCOLLECTOR configuration option is enabled and METRICSALLOWEDNETWORKS is set to 127.0.0.1/8 (the default).
Patches
PR #1745 fixes the problem. Available in Miniflux >= 2.0.43.
Workarounds
Set METRICSCOLLECTOR to false (default) or run Miniflux behind a trusted reverse-proxy.
References
- https://miniflux.app/docs/configuration.html#metrics-collector - https://miniflux.app/docs/configuration.html#metrics-allowed-networks
Other sources
Miniflux is a feed reader. Prior to version 2.0.43, an unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the METRICSCOLLECTOR configuration option is enabled and METRICSALLOWEDNETWORKS is set to 127.0.0.1/8 (the default). A patch is available in Miniflux 2.0.43. As a workaround, set METRICSCOLLECTOR to false (default) or run Miniflux behind a trusted reverse-proxy.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-27591?
CVE-2023-27591 has a medium severity level due to the potential exposure of sensitive metrics data.
How do I fix CVE-2023-27591?
To fix CVE-2023-27591, upgrade Miniflux to version 2.0.43 or later, ensuring the METRICS_COLLECTOR option is configured securely.
What vulnerabilities are associated with CVE-2023-27591?
CVE-2023-27591 allows unauthenticated access to Prometheus metrics, risking exposure of application performance data.
Which versions of Miniflux are affected by CVE-2023-27591?
CVE-2023-27591 affects Miniflux versions prior to 2.0.43 and versions of the Miniflux.app package up to 1.0.46.
Is CVE-2023-27591 related to any specific configuration settings?
Yes, CVE-2023-27591 is particularly relevant when the METRICS_COLLECTOR option is enabled and METRICS_ALLOWED_NETWORKS is set improperly.