PT-2017-18903 · Subsonic · Subsonic

Hyp3Rlinx + 1 · Publicado 2017-07-25 · Atualizado 2017-07-28 · CVE-2017-9413

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Subsonic version 6.1.1

Description The issue affects the Podcast feature, allowing remote attackers to hijack user authentication for specific requests. This can be achieved through exploiting cross-site request forgery (CSRF) vulnerabilities, particularly when (1) subscribing to a podcast via the add parameter to "podcastReceiverAdmin.view" or (2) updating Internet Radio Settings via the urlRedirectCustomUrl parameter to "networkSettings.view". These vulnerabilities can also be exploited to conduct server-side request forgery (SSRF) attacks.

Recommendations For Subsonic version 6.1.1, consider disabling the Podcast feature temporarily to prevent exploitation until a patch is available. Restrict access to the "podcastReceiverAdmin.view" and "networkSettings.view" endpoints to minimize the risk of CSRF and SSRF attacks. Avoid using the add parameter and the urlRedirectCustomUrl parameter in the affected API endpoints until the issue is resolved.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2017-9413

Produtos afetados

Subsonic

Referências · 4

• 🔥 https://exploit-db.com/exploits/42118 · Exploit
• 🔥 http://packetstormsecurity.com/files/142794/Subsonic-6.1.1-Server-Side-Request-Forgery.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-9413 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-9413 · Aviso do Fabricante