CVE-2023-27591: Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics

Vulnerability summary

CVE-2023-27591 is a high (CVSS 7.5) vulnerability in miniflux_project miniflux. EPSS estimates a 0.76% chance of exploitation in the next 30 days, higher than 54.6% of scored vulnerabilities.

Timeline

1. 17-03-2023
   PublishedVulnerability first disclosed.
2. 25-02-2025
   Last modifiedVulnerability information updated.

Description

Miniflux is a feed reader. Prior to version 2.0.43, an unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the `METRICS_COLLECTOR` configuration option is enabled and `METRICS_ALLOWED_NETWORKS` is set to `127.0.0.1/8` (the default). A patch is available in Miniflux 2.0.43. As a workaround, set `METRICS_COLLECTOR` to `false` (default) or run Miniflux behind a trusted reverse-proxy.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
• CWE-1220Insufficient Granularity of Access ControlThe product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.