PT-2023-31876 · Unknown · Audiobookshelf

Sylwia-Budzynska · Published 2023-12-27 · Updated 2024-01-11 · CVE-2023-51665

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Audiobookshelf versions prior to 2.7.0

Description Audiobookshelf is a self-hosted audiobook and podcast server. The issue is related to an unauthenticated blind server-side request (SSRF) vulnerability in Auth.js. This vulnerability has been addressed in version 2.7.0. There are no known workarounds for this issue.

Recommendations For versions prior to 2.7.0, update to version 2.7.0 to resolve the issue. As a temporary workaround, consider restricting access to the Auth.js module until the update is applied.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2023-51665

GHSA-GJGJ-98V3-47PG

Affected Products

Audiobookshelf

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51665.json · Exploit
• https://github.com/advplyr/audiobookshelf/commit/728496010cbfcee5b7b54001c9f79e02ede30d82 · Patch
• https://osv.dev/vulnerability/CVE-2023-51665 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-51665 · Security Note
• https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-gjgj-98v3-47pg · Note
• https://twitter.com/GHSecurityLab/status/1745534546848759996 · Twitter Post
• https://twitter.com/RedPacketSec/status/1740674633265824131 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1740094704241295669 · Twitter Post
• https://t.me/cvenotify/66389 · Telegram Post
• https://twitter.com/CVEnew/status/1740064482204725253 · Twitter Post