Cross-site scripting in SABnzbd - #VU153371

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary JavaScript in the authenticated SABnzbd web origin.

The vulnerability exists due to improper encoding of untrusted output in the Quick-Start Wizard and server configuration interface when rendering NNTP server-test error messages as HTML. A remote attacker can return a specially crafted NNTP error response containing event-handler markup to execute arbitrary JavaScript in the authenticated SABnzbd web origin.

Exploitation requires control of the selected NNTP server or interception of a plaintext NNTP connection, and an authenticated administrator must click Test Server. The injected script can access the page's API key and use its SABnzbd API authority even when the web interface is bound to localhost.

Affected software

Remediation

External References

• https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-c5x2-896f-g5g8
• https://github.com/sabnzbd/sabnzbd/releases/tag/5.2.0Beta2

Related Security Bulletins

• Multiple vulnerabilities in SABnzbd