SB2021050717 - Path traversal in SABnzbd

Description

This security bulletin contains information about 1 vulnerability.

1) Path traversal (CVE-ID: CVE-2021-29488)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to create files outside the configured download folder.

The vulnerability exists due to improper path restriction in filesystem.renamer() when processing malicious PAR2 files from a downloaded NZB. A remote attacker can supply a crafted NZB that retrieves malicious PAR2 files to create files outside the configured download folder.

Exploitation requires the target to add a crafted NZB to the download queue, including through automated third-party integrations. The issue is limited to creating new files and does not allow overwriting, modifying, or deleting existing files.

Remediation

Install update from vendor's website.

References

• https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-jwj3-wrvf-v3rp
• https://github.com/sabnzbd/sabnzbd/commit/3766ba54026eaa520dbee5b57a2f33d4954fb98b