PT-2023-31518 · Bazarr · Bazarr

Sylwia Budzynska · Published 2023-12-15 · Updated 2023-12-19 · CVE-2023-50265

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bazarr versions prior to 1.3.1

Description The issue arises from the lack of validation of the user-controlled filename variable in the /api/swaggerui/static endpoint, which is located in bazarr/app/ui.py. This oversight allows the variable to be used in the send file function, resulting in an arbitrary file read on the system.

Recommendations For versions prior to 1.3.1, update to version 1.3.1 to resolve the issue. As a temporary workaround, consider restricting access to the /api/swaggerui/static endpoint until the update is applied. Avoid using the filename variable in the affected endpoint until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-50265

Affected Products

Bazarr

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50265.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2023-192_GHSL-2023-194_bazarr · Exploit
• https://github.com/morpheus65535/bazarr/commit/17add7fbb3ae1919a40d505470d499d46df9ae6b · Patch
• https://osv.dev/vulnerability/CVE-2023-50265 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50265 · Security Note
• https://github.com/morpheus65535/bazarr/releases/tag/v1.3.1 · Note
• https://t.me/cvenotify/64263 · Telegram Post
• https://twitter.com/CVEnew/status/1735946016619405529 · Twitter Post
• https://t.me/cvenotify/63842 · Telegram Post