CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-43797 – Path Traversal in audiobookshelf
https://notcve.org/view.php?id=CVE-2024-43797
audiobookshelf is a self-hosted audiobook and podcast server. A non-admin user is not allowed to create libraries (or access only the ones they have permission to). However, the `LibraryController` is missing the check for admin user and thus allows a path traversal issue. Allowing non-admin users to write to any directory in the system can be seen as a form of path traversal. However, since it can be restricted to only admin permissions, fixing this is relatively simple and falls more into the realm of Role-Based Access Control (RBAC). • https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-gg56-vj58-g5mc https://github.com/advplyr/audiobookshelf-ghsa-gg56-vj58-g5mc/pull/1 https://github.com/advplyr/audiobookshelf/blob/1c0d6e9c670ebb1b6f1e427a4c4d9250a7fb9b80/server/controllers/LibraryController.js#L43-L47 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-35236 – Audiobookshelf Cross-Site-Scripting vulnerability via crafted ebooks
https://notcve.org/view.php?id=CVE-2024-35236
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to version 2.10.0, opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Attacking a user with high privileges (upload, creation of libraries) can lead to remote code execution (RCE) in the worst case. This was tested on version 2.9.0 on Windows, but an arbitrary file write is powerful enough as is and should easily lead to RCE on Linux, too. Version 2.10.0 contains a patch for the vulnerability. • https://github.com/advplyr/audiobookshelf/assets/36849099/46f6dfe0-9860-4ec0-a987-b3a553f7e45d https://github.com/advplyr/audiobookshelf/blob/04ed4810fdfcafc2e82db536edc5870e3f937d00/client/components/readers/EpubReader.vue#L319 https://github.com/advplyr/audiobookshelf/commit/ce7f891b9b2cb57c6644aaf96f89a8bda6307664 https://github.com/advplyr/audiobookshelf/releases/tag/v2.10.0 https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-7j99-76cj-q9pg • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-51665 – Audiobookshelf vulnerable to Blind SSRF in `Auth.js`
https://notcve.org/view.php?id=CVE-2023-51665
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenticated blind server-side request (SSRF) vulnerability in Auth.js. This vulnerability has been addressed in version 2.7.0. There are no known workarounds for this vulnerability. Audiobookshelf es un servidor de podcasts y audiolibros autohospedado. • https://github.com/advplyr/audiobookshelf/commit/728496010cbfcee5b7b54001c9f79e02ede30d82 https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-gjgj-98v3-47pg • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-51697 – Audiobookshelf vulnerable to Blind SSRF in `podcastUtils.js`
https://notcve.org/view.php?id=CVE-2023-51697
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenticated blind server-side request (SSRF) vulnerability in `podcastUtils.js`. This vulnerability has been addressed in version 2.7.0. There are no known workarounds for this vulnerability. Audiobookshelf es un servidor de podcasts y audiolibros autohospedado. • https://github.com/advplyr/audiobookshelf/commit/f2f2ea161ca0701e1405e737b0df0f96296e4f64 https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-jhjx-c3wx-q2x7 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-47624 – Audiobookshelf Arbitrary File Read Vulnerability
https://notcve.org/view.php?id=CVE-2023-47624
Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, any user (regardless of their permissions) may be able to read files from the local file system due to a path traversal in the `/hls` endpoint. This issue may lead to Information Disclosure. As of time of publication, no patches are available. Audiobookshelf es un servidor de podcasts y audiolibros autohospedado. • https://github.com/advplyr/audiobookshelf/blob/d7b2476473ef1934eedec41425837cddf2d4b13e/server/routers/HlsRouter.js#L32 https://securitylab.github.com/advisories/GHSL-2023-203_GHSL-2023-204_audiobookshelf • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •