PT-2023-31512 · Medusa · Medusa

Sylwia-Budzynska · Published 2023-12-22 · Updated 2024-01-03 · CVE-2023-50258

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Medusa versions prior to 1.0.19

Description Medusa is an automatic video library manager for TV shows. The issue is related to unauthenticated blind server-side request forgery (SSRF). The testDiscord request handler in medusa/server/web/home/handler.py does not validate the user-controlled discord webhook variable and passes it to the notifiers.discord notifier.test notify method, then notify discord and finally send discord msg method, which sends a POST request to the user-controlled URL on line 64 in /medusa/notifiers/discord.py. This allows for crafting POST requests on behalf of the Medusa server.

Recommendations For versions prior to 1.0.19, update to version 1.0.19 to resolve the issue. As a temporary workaround, consider disabling the testDiscord request handler in medusa/server/web/home/handler.py until a patch is available. Restrict access to the discord webhook variable to minimize the risk of exploitation. Avoid using the discord webhook variable in the affected API endpoint until the issue is resolved.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2023-50258

GHSA-3HPH-6586-QV9G

Affected Products

Medusa

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50258.json · Exploit
• 🔥 https://github.com/pymedusa/Medusa/security/advisories/GHSA-3hph-6586-qv9g · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2023-201_GHSL-2023-202_Medusa · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-50258 · Security Note
• https://osv.dev/vulnerability/CVE-2023-50258 · Vendor Advisory
• https://github.com/pymedusa/Medusa/releases/tag/v1.0.19 · Note
• https://github.com/pymedusa/Medusa/blob/3d656652ab277e47689483912ed7fc443e7023e8/medusa/notifiers/discord.py#L64 · Note
• https://github.com/pymedusa/Medusa/blob/3d656652ab277e47689483912ed7fc443e7023e8/medusa/server/web/home/handler.py#L158 · Note
• https://t.me/cvenotify/66110 · Telegram Post