CVE-2024-35236

Audiobookshelf Cross-Site-Scripting vulnerability via crafted ebooks

Severity Score

4.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to version 2.10.0, opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Attacking a user with high privileges (upload, creation of libraries) can lead to remote code execution (RCE) in the worst case. This was tested on version 2.9.0 on Windows, but an arbitrary file write is powerful enough as is and should easily lead to RCE on Linux, too. Version 2.10.0 contains a patch for the vulnerability.

Audiobookshelf es un servidor de podcasts y audiolibros autohospedado. Antes de la versión 2.10.0, abrir un libro electrónico con scripts maliciosos en su interior provocaba la ejecución del código dentro del contexto de navegación. Atacar a un usuario con altos privilegios (carga, creación de librerías) puede provocar la ejecución remota de código (RCE) en el peor de los casos. Esto se probó en la versión 2.9.0 en Windows, pero una escritura de archivo arbitraria es lo suficientemente potente como está y debería conducir fácilmente a RCE también en Linux. La versión 2.10.0 contiene un parche para la vulnerabilidad.

*Credits: N/A

CVSS Scores

GitHubv3.1 4.8

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

Poc

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-05-14 CVE Reserved
2024-05-27 CVE Published
2024-05-28 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (5)

URL	Tag	Source
https://github.com/advplyr/audiobookshelf/assets/36849099/46f6dfe0-9860-4ec0-a987-b3a553f7e45d	X_refsource_misc
https://github.com/advplyr/audiobookshelf/blob/04ed4810fdfcafc2e82db536edc5870e3f937d00/client/components/readers/EpubReader.vue#L319	X_refsource_misc
https://github.com/advplyr/audiobookshelf/commit/ce7f891b9b2cb57c6644aaf96f89a8bda6307664	X_refsource_misc
https://github.com/advplyr/audiobookshelf/releases/tag/v2.10.0	X_refsource_misc
https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-7j99-76cj-q9pg	X_refsource_confirm

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Advplyr Search vendor "Advplyr"		Audiobookshelf Search vendor "Advplyr" for product "Audiobookshelf"				< 2.10.0 Search vendor "Advplyr" for product "Audiobookshelf" and version " < 2.10.0"		en		Affected