SB2020080104 - Input validation error in SABnzbd

Description

This security bulletin contains information about 1 vulnerability.

1) Input validation error (CVE-ID: CVE-2020-13124)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper input validation in the isFAT() function in checkdir.py and related settings handling when processing specially crafted Completed Download Folder, Nice, or IONice Parameters settings through the web interface. A remote attacker can submit specially crafted settings values to execute arbitrary code.

Exploitation requires access to the web interface. By default, the web interface is only accessible from localhost, and Windows systems are not affected.

Remediation

Install update from vendor's website.

References

• https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-9x87-96gg-33w2
• https://github.com/sabnzbd/sabnzbd/commit/dfcba6e2fb37f58fea06b453b1ba258c7f110429