Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a vulnerability in the Readest ebook reader application that could allow an unauthenticated remote attacker to use the service as an open request proxy. In certain deployments, this could enable the retrieval of internal network information or responses from internal services by fetching arbitrary URLs. While some deployment environments may have reduced risk, the core fetch-and-reflect behavior remains a concern.
- Attackers can use Readest as a proxy.
- Allows access to internal service information.
- Confirm Readest relevance and exposure.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this vulnerability by sending a crafted request to the `/api/opds/proxy` endpoint. This endpoint, available without authentication, allows the application to fetch content from a URL provided by the user. The vulnerability lies in the application's failure to properly validate these URLs, enabling it to retrieve resources from internal networks or cloud environments. This could lead to the exposure of sensitive internal information or system responses.
- No authentication required.
- Crafted request to API endpoint.
- Exposes internal data and responses.
Live Threat
Current exploitation, exposure, and threat context
An unauthenticated API endpoint in Readest could be exploited as an open request proxy when deployed on self-hosted infrastructure with internal network access. This could allow an attacker to retrieve sensitive cloud metadata or internal service responses by directing the application to fetch resources from internal network locations.
- Internal network data or services at risk.
- Unauthenticated proxy allows fetching internal resources.
- Exposure of sensitive cloud or service information.
Operational Fix
Recommended remediation, mitigation, and detection steps
Owners of the Readest application, likely within platform or infrastructure teams, are responsible for addressing this critical vulnerability. The first practical step is to identify all instances of Readest, especially those deployed on Node, Docker, or self-hosted environments with internal network access, as these are most susceptible to exploitation for retrieving cloud metadata or internal service responses. Confirming the reachability and business criticality of each instance will inform prioritization for remediation.
- Application and platform teams own remediation.
- Verify all Readest deployments and network exposure.
- Plan maintenance for critical, exposed instances.
