RSS and Feed Import SSRF: Server-Side Fetches Hidden in Readers
"Add feed by URL" looks like a content feature. On the server it is often a full HTTP client with XML parsing, redirect following, and scheduled refresh. That combination has produced more SSRF tickets than its quiet UI suggests.
Blog platforms, podcast hosts, media monitors, and "subscribe to updates" widgets all qualify.
Map the import flow
Submit a feed URL pointing at an Atom or RSS document you host. Confirm the application retrieves it and parses entries. Note whether refresh jobs re-fetch on a timer—those make durable SSRF beacons if a hostile URL remains saved.
Inspect your server logs for the bot's user agent, accepted protocols, and whether it sends cookies. Some importers retrieve linked enclosures (audio, images) with a second client that has different filters. Test the feed URL and enclosure URLs as separate SSRF surfaces. Podcast "episode image" and media RSS modules are easy to miss if you only watch the top-level GET.
Filters, redirects, and XML
Try a feed hosted on a public domain that 302s to your collaborator on an internal-looking path only if policy allows. Many allowlists check the first hop and trust the rest. Redirect to a URL that returns a tiny valid feed so the product shows a successful import while your logs show the internal touch—again, only with approved targets.
RSS is XML. Host a feed that includes external entities and see whether the parser expands them when displaying titles or descriptions. Keep OOB entity targets on infrastructure you control. You may leave with SSRF, XXE, or both; file them as linked issues if evidence supports it.
Malformed feeds that trigger stack traces can disclose parser libraries and internal paths. Useful context—not the whole report. Also try feed:// and protocol-relative URLs if the UI accepts them; some normalizers rewrite poorly and open unexpected schemes.
Impact framing
Blind collaborator hits from a feed importer are credible SSRF. Full-response SSRF appears when feed error messages or debugging previews echo upstream bodies. Scheduled fetch raises severity slightly because it persists after the attacker logs out.
Do not import feeds that point at third-party production admin panels. Use canary hosts and documented safe internal endpoints. Delete the subscription when you finish so refresh workers stop dialing your listener.
Closing the ticket
Describe the UI entry point, the stored feed ID, request traces, and cleanup steps you took (delete the feed). Suggest allowlisted schemes, IP range blocks on every hop, size limits, disabled DTDs, separate egress for media enclosures, and admin alerts for repeated fetch failures.
Feed import SSRF rarely needs a fancy payload. It needs a patient redirect chain, an owned XML document, and a clear sentence about which network range the reader should never have dialed. If OPML import exists, feed a file with multiple canary URLs. Bulk subscribe paths sometimes skip per-URL checks that the single-add form enforces. Keep the OPML tiny—two or three entries—so you prove the miss without flooding refresh workers.