PT-2017-18903 · Subsonic · Subsonic

Hyp3Rlinx + 1 · Published 2017-07-25 · Updated 2017-07-28 · CVE-2017-9413

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Subsonic version 6.1.1

Description The issue affects the Podcast feature, allowing remote attackers to hijack user authentication for specific requests. This can be achieved through exploiting cross-site request forgery (CSRF) vulnerabilities, particularly when (1) subscribing to a podcast via the add parameter to "podcastReceiverAdmin.view" or (2) updating Internet Radio Settings via the urlRedirectCustomUrl parameter to "networkSettings.view". These vulnerabilities can also be exploited to conduct server-side request forgery (SSRF) attacks.

Recommendations For Subsonic version 6.1.1, consider disabling the Podcast feature temporarily to prevent exploitation until a patch is available. Restrict access to the "podcastReceiverAdmin.view" and "networkSettings.view" endpoints to minimize the risk of CSRF and SSRF attacks. Avoid using the add parameter and the urlRedirectCustomUrl parameter in the affected API endpoints until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-9413

Affected Products

Subsonic

References · 4

• 🔥 https://exploit-db.com/exploits/42118 · Exploit
• 🔥 http://packetstormsecurity.com/files/142794/Subsonic-6.1.1-Server-Side-Request-Forgery.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-9413 · Security Note
• https://osv.dev/vulnerability/CVE-2017-9413 · Vendor Advisory