Cross-site scripting in SABnzbd - #VU153370

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary JavaScript in the SABnzbd web interface and access the API key.

The vulnerability exists due to incomplete HTML sanitization in get_last_line() in postproc.py and the Glitter download history interface when processing and rendering post-processing script output. A remote attacker can supply a crafted X-DNZB-Failure HTTP response header or an NZB file containing crafted failure metadata to execute arbitrary JavaScript in the SABnzbd web interface and access the API key.

Exploitation requires a configured post-processing script that produces more than one line of output and echoes attacker-controlled metadata on its final line. The provided Sample-PostProc.sh script meets these requirements. A user must expand the job details in the download history to trigger execution.

Affected software

Remediation

External References

• https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-rpwc-qfxm-7h2v
• https://github.com/sabnzbd/sabnzbd/releases/tag/5.2.0Beta2

Related Security Bulletins

• Multiple vulnerabilities in SABnzbd