SB2026100657 - Multiple vulnerabilities in SABnzbd

Description

This security bulletin contains information about 2 vulnerabilities.

1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute arbitrary JavaScript in the SABnzbd web interface and access the API key.

The vulnerability exists due to incomplete HTML sanitization in get_last_line() in postproc.py and the Glitter download history interface when processing and rendering post-processing script output. A remote attacker can supply a crafted X-DNZB-Failure HTTP response header or an NZB file containing crafted failure metadata to execute arbitrary JavaScript in the SABnzbd web interface and access the API key.

Exploitation requires a configured post-processing script that produces more than one line of output and echoes attacker-controlled metadata on its final line. The provided Sample-PostProc.sh script meets these requirements. A user must expand the job details in the download history to trigger execution.

2) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute arbitrary JavaScript in the authenticated SABnzbd web origin.

The vulnerability exists due to improper encoding of untrusted output in the Quick-Start Wizard and server configuration interface when rendering NNTP server-test error messages as HTML. A remote attacker can return a specially crafted NNTP error response containing event-handler markup to execute arbitrary JavaScript in the authenticated SABnzbd web origin.

Exploitation requires control of the selected NNTP server or interception of a plaintext NNTP connection, and an authenticated administrator must click Test Server. The injected script can access the page's API key and use its SABnzbd API authority even when the web interface is bound to localhost.

Remediation

Install update from vendor's website.

References

• https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-rpwc-qfxm-7h2v
• https://github.com/sabnzbd/sabnzbd/releases/tag/5.2.0Beta2
• https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-c5x2-896f-g5g8