Readest Open Request Proxy Vulnerability

Readest, a cross-platform ebook reader, is vulnerable to an open request proxy issue in its unauthenticated /api/opds/proxy route. The route accepts an attacker-controlled URL and fetches it server-side without:

• restricting the URL scheme,
• blocking private, loopback, link-local, or metadata hosts,
• revalidating destinations during automatic redirect following.

The route also accepts caller-controlled outbound headers and Authorization values and reflects the upstream status and response body. A remote attacker can use the service as an open request proxy and, on Node, Docker, or other self-hosted deployments with internal-network access, retrieve cloud metadata or internal-service responses.

Cloudflare Workers deployments restrict access to link-local and private destinations, reducing internal-network impact, but the unauthenticated public fetch-and-reflect behavior remains. The issue is fixed in version 0.11.10.