PT-2023-31519 · Bazarr · Bazarr

Sylwia Budzynska · Published 2023-12-15 · Updated 2023-12-19 · CVE-2023-50266

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bazarr versions 1.2.4 through 1.3.0

Description Bazarr manages and downloads subtitles. The proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get() without any sanitization, which leads to a blind server-side request forgery (SSRF). This issue allows for crafting GET requests to internal and external resources on behalf of the server.

Recommendations For versions 1.2.4 through 1.3.0, consider disabling the proxy method in bazarr/bazarr/app/ui.py until a full fix is available. For version 1.3.1, although it contains a partial fix, it is still recommended to restrict access to the proxy method to minimize the risk of exploitation, as the vulnerability is limited to HTTP/HTTPS protocols.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2023-50266

Affected Products

Bazarr

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50266.json · Exploit
• https://github.com/morpheus65535/bazarr/commit/17add7fbb3ae1919a40d505470d499d46df9ae6b · Patch
• https://securitylab.github.com/advisories/GHSL-2023-192_GHSL-2023-194_bazarr · Patch
• https://osv.dev/vulnerability/CVE-2023-50266 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50266 · Security Note
• https://github.com/morpheus65535/bazarr/releases/tag/v1.3.1 · Note
• https://twitter.com/CVEnew/status/1735946015633739944 · Twitter Post
• https://t.me/cvenotify/63843 · Telegram Post