Description

Koel is a free, open-source music streaming solution. Prior to 9.7.1, outbound podcast and radio fetch paths perform a point-in-time App\Helpers\Network::isPublicHost() or isSafeUrl() check without pinning the validated address, and most paths lack redirect-hop validation and do not revalidate every redirect target. PhanAn\Poddle\Poddle::fromUrl(), PodcastService::getStreamableUrl(), PodcastService::isPodcastObsolete(), App\Rules\HasAudioContentType, and App\Rules\SafeUrl can therefore follow an attacker-controlled redirect to an internal address or connect after DNS rebinding changes a public resolution to a private one. These paths are reachable through podcast and radio APIs, including createPodcastChannel, createInternetRadioStation, refreshPodcasts, apiResource podcasts, and radio/stations, allowing an authenticated user to request internal services or cloud metadata and potentially receive parsed or streamed response content. This issue is fixed in version 9.7.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-19T21:16:57.453Z",
  "pubdate": "2026-08-19T21:16:57.453Z",
  "executiveSummary": "Koel prior to version 9.7.1 is affected by a Server-Side Request Forgery (SSRF) vulnerability in outbound podcast and radio fetch paths. The flaw arises because these components perform initial validation checks using App\\Helpers\\Network::isPublicHost() or isSafeUrl() without pinning the validated IP address, and lack redirect-hop validation across subsequent redirects.\nAn authenticated user with access to podcast and radio APIs can exploit this vulnerability by supplying malicious URLs or redirect chains. This allows attackers to bypass security checks through Time-of-Check to Time-of-Use (TOCTOU) conditions, including DNS rebinding or following redirects to internal network addresses and cloud metadata services.\nSuccessful exploitation enables attackers to interact with internal services or cloud metadata endpoints, potentially receiving parsed or streamed response content from resources that should otherwise be isolated from the external network.\nThe vulnerability affects multiple internal functions and classes, including PhanAn\\Poddle\\Poddle::fromUrl(), PodcastService::getStreamableUrl(), PodcastService::isPodcastObsolete(), App\\Rules\\HasAudioContentType, and App\\Rules\\SafeUrl, as well as specific API endpoints such as createPodcastChannel, createInternetRadioStation, refreshPodcasts, apiResource podcasts, and radio/stations.\nMitigation requires upgrading Koel to version 9.7.1 or later, where the issue is officially resolved.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient validation and lack of address pinning during outbound HTTP requests initiated by podcast and radio fetch paths. Prior to version 9.7.1, functions such as PhanAn\\Poddle\\Poddle::fromUrl(), PodcastService::getStreamableUrl(), PodcastService::isPodcastObsolete(), App\\Rules\\HasAudioContentType, and App\\Rules\\SafeUrl execute a point-in-time check via App\\Helpers\\Network::isPublicHost() or isSafeUrl() to determine if a target URL is safe.\nHowever, these checks do not bind the validated IP address to the subsequent HTTP connection socket. Consequently, a race condition occurs between the Time-of-Check and Time-of-Use (TOCTOU). If an attacker utilizes DNS rebinding, a domain name that initially resolves to a public IP address during the validation phase can resolve to an internal IP address or cloud metadata service when the actual connection is established.\nFurthermore, most affected paths lack redirect-hop validation and fail to revalidate every redirect target. When a target URL returns an HTTP redirect status code, the underlying HTTP client follows the redirection chain without re-evaluating the safety of the new destination URL using App\\Helpers\\Network::isPublicHost() or isSafeUrl(). This allows an attacker-controlled external server to issue a redirect pointing to internal resources, such as localhost, private subnet services (e.g., 169.254.169.254 for cloud metadata), or internal network infrastructure.\nThe attack flow proceeds as follows: First, an authenticated user interacts with exposed podcast and radio APIs, including createPodcastChannel, createInternetRadioStation, refreshPodcasts, apiResource podcasts, or radio/stations. The user submits a malicious URL pointing to a controlled external domain or a crafted redirect script. Second, Koel invokes validation rules like App\\Rules\\SafeUrl or App\\Rules\\HasAudioContentType, which temporarily pass because the initial URL points to a public host. Third, during the fetch operation, the application either falls victim to a DNS rebinding attack or follows an untrusted redirect chain to an internal target. Finally, the application connects to the internal service or cloud metadata endpoint, processes the payload, and potentially returns the parsed or streamed response content back to the user via the application interface.\nVulnerable components include PhanAn\\Poddle\\Poddle::fromUrl(), PodcastService::getStreamableUrl(), PodcastService::isPodcastObsolete(), App\\Rules\\HasAudioContentType, and App\\Rules\\SafeUrl. Exploitation requires authentication to access the affected podcast and radio management APIs."
}