GHSA-w79m-f3jx-779v: Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation

Summary Koel v9.6.0 protects the regular podcast subscription API with SafeUrl, but the Subsonic-compatible createPodcastChannel.view route does not apply the same protection. An authenticated user can supply a private URL and cause Koel to fetch it server-side during podcast parsing. This was validated against v9.6.0 (352ea5ec27fa22294da8fb6beacb3d5552f0d09c) using the official phanan/koel:9.6.0 image. This is distinct from GHSA-7j2f-6h2r-6cqc, which fixed unsafe episode enclosure URLs in versions <= 9.3.4. The issue here is a newer validation gap in the Subsonic route itself, still present in v9.6.0. Details SafeUrl protects the regular podcast API only The regular podcast subscription path validates the feed URL with SafeUrl: - app/Http/Requests/API/Podcast/PodcastStoreRequest.php return [ 'url' => ['required', 'url', new SafeUrl()], ]; The Subsonic-compatible route does not: - routes/subsonic.php - createPodcastChannel.view - app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php return [ 'url' => ['required', 'string', 'url'], ]; That creates the same kind of trust-boundary mismatch as the radio issue: the main API rejects private targets, while the compatibility route accepts them. The URL is fetched immediately by the podcast parser The attacker-controlled URL is used by the podcast service during channel creation: - app/Http/Controllers/Subsonic/CreatePodcastChannelController.php - app/Services/Podcast/PodcastService.php PodcastService::addPodcast() calls: $parser = $this->createParser($url); and createParser() resolves to: return Poddle::fromUrl($url, 5 * 60, $this->client); This means the SSRF happens as part of the channel creation flow itself. No separate playback step is needed. This bypasses Koel's intended SSRF control for podcast URLs Koel already added SafeUrl to the regular podcast API and has already published a podcast-related SSRF advisory. The Subsonic route does not reuse that same control, so it reintroduces a server-s