PT-2023-31517 · Bazarr · Bazarr

Sylwia Budzynska · Published 2023-12-15 · Updated 2023-12-19 · CVE-2023-50264

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bazarr versions prior to 1.3.1

Description Bazarr manages and downloads subtitles. The issue arises from the /system/backup/download/ endpoint in bazarr/app/ui.py, where the filename variable, controlled by the user, is not validated and is used in the send file function. This leads to an arbitrary file read on the system.

Recommendations For versions prior to 1.3.1, update to version 1.3.1 to resolve the issue. As a temporary workaround, consider restricting access to the /system/backup/download/ endpoint until a patch is available. Avoid using the filename variable in the affected endpoint until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-50264

Affected Products

Bazarr

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50264.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2023-192_GHSL-2023-194_bazarr · Exploit
• https://github.com/morpheus65535/bazarr/commit/17add7fbb3ae1919a40d505470d499d46df9ae6b · Patch
• https://osv.dev/vulnerability/CVE-2023-50264 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50264 · Security Note
• https://github.com/morpheus65535/bazarr/releases/tag/v1.3.1 · Note
• https://twitter.com/CVEnew/status/1735946017508614365 · Twitter Post
• https://t.me/cvenotify/63841 · Telegram Post
• https://t.me/cvenotify/64262 · Telegram Post