PinePods Podcast Manager SSRF Vulnerability

PinePods, a self-hosted podcast management system written in Rust, is affected by a server-side request forgery (SSRF) vulnerability fixed in version 0.9.0. An authenticated user can subscribe to an attacker-controlled RSS feed through POST /api/data/add_podcast in rust-api/src/handlers/podcasts.rs.

The feed parsing functions get_podcast_values and add_episodes in rust-api/src/database.rs store the enclosure url verbatim in Episodes.episodeurl without destination host/IP validation. A later request to POST /api/data/download_podcast triggers spawn_download_podcast_episode and download_episode_and_wait() in rust-api/src/services/tasks.rs, sending a reqwest GET to the stored URL and saving the response in DownloadedEpisodes for later retrieval. The estimate_duration_from_audio_url_async() path in rust-api/src/database.rs also sends an unvalidated HEAD during feed add/refresh.

Default redirect following permits an initially external enclosure URL to redirect to an internal target. This allows a low-privilege user to make server-side GET/HEAD requests to reachable loopback, private-network and cloud metadata services and read downloaded internal responses.

• Affects PinePods before 0.9.0.
• Requires an authenticated user; self-service signup is supported.
• Episode downloading requires server downloads to be enabled, which is the default.
• Impact includes internal-service enumeration, confidential-data disclosure and possible metadata credential theft.