CVE-2023-27591
📋 TL;DR
This vulnerability allows unauthenticated attackers to access Prometheus metrics from publicly exposed Miniflux instances with metrics collection enabled. It affects Miniflux instances where METRICS_COLLECTOR is enabled and METRICS_ALLOWED_NETWORKS is set to the default 127.0.0.1/8. The metrics could contain sensitive system information.
💻 Affected Systems
- Miniflux
📦 What is this software?
Miniflux by Miniflux Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain sensitive system metrics including performance data, resource usage, and potentially internal network information that could facilitate further attacks.
Likely Case
Information disclosure of system metrics that could help attackers profile the system and identify potential weaknesses for follow-up attacks.
If Mitigated
No information disclosure; metrics remain accessible only to authorized localhost connections.
🎯 Exploit Status
Simple HTTP request to metrics endpoint when instance is publicly accessible
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.43
Vendor Advisory: https://github.com/miniflux/v2/security/advisories/GHSA-3qjf-qh38-x73v
Restart Required: Yes
Instructions:
1. Update Miniflux to version 2.0.43 or later. 2. Restart the Miniflux service. 3. Verify metrics endpoint is properly restricted.
🔧 Temporary Workarounds
Disable metrics collector
allSet METRICS_COLLECTOR configuration option to false
Set METRICS_COLLECTOR=false in Miniflux configuration
Use reverse proxy
allRun Miniflux behind a trusted reverse proxy that restricts access to metrics endpoint
🧯 If You Can't Patch
- Disable METRICS_COLLECTOR in configuration
- Implement network-level restrictions to block external access to metrics endpoint
🔍 How to Verify
Check if Vulnerable:
Check if METRICS_COLLECTOR is enabled and attempt to access /metrics endpoint from external networkCheck Version:
Check Miniflux version in web interface or via miniflux --version commandVerify Fix Applied:
After patching, verify that external requests to /metrics endpoint are properly rejected📡 Detection & Monitoring
Log Indicators:
- External IP addresses accessing /metrics endpoint
- Failed authentication attempts to metrics endpoint
Network Indicators:
- External traffic to /metrics endpoint on Miniflux port
SIEM Query:
source_ip NOT IN (127.0.0.0/8) AND destination_port = [MINIFLUX_PORT] AND uri_path = '/metrics'🔗 References
- https://github.com/miniflux/v2/pull/1745
- https://github.com/miniflux/v2/releases/tag/2.0.43
- https://github.com/miniflux/v2/security/advisories/GHSA-3qjf-qh38-x73v
- https://miniflux.app/docs/configuration.html#metrics-collector
- https://github.com/miniflux/v2/pull/1745
- https://github.com/miniflux/v2/releases/tag/2.0.43
- https://github.com/miniflux/v2/security/advisories/GHSA-3qjf-qh38-x73v
- https://miniflux.app/docs/configuration.html#metrics-collector
