PT-2025-3012 · Sickchill · Sickchill

Sylwia Budzynska + 1 · Published 2025-01-08 · Updated 2025-11-29 · CVE-2024-53995

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions SickChill versions prior to commit c7128a8946c3701df95c285810eb75b2de18bf82

Description The issue concerns an open redirect in the login endpoint of SickChill, an automatic video library manager for TV shows. A user-controlled login endpoint's next parameter takes arbitrary content, allowing an authenticated attacker to redirect the user to arbitrary destinations. This is possible because the login page redirects to the next parameter. The commit c7128a8946c3701df95c285810eb75b2de18bf82 changes this behavior, redirecting instead to settings.DEFAULT PAGE.

Recommendations For versions prior to commit c7128a8946c3701df95c285810eb75b2de18bf82, update to a version that includes the commit c7128a8946c3701df95c285810eb75b2de18bf82 to resolve the issue. As a temporary workaround, consider restricting access to the login endpoint or disabling the next parameter to minimize the risk of exploitation.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-53995

GHSA-6GF2-FFQ8-GCWW

Affected Products

Sickchill

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53995.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-53995 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53995 · Security Note
• https://osv.dev/vulnerability/GHSA-6gf2-ffq8-gcww · Vendor Advisory
• https://github.com/SickChill/sickchill · Note
• https://github.com/SickChill/sickchill/pull/8811 · Note
• https://github.com/SickChill/sickchill/commit/c7128a8946c3701df95c285810eb75b2de18bf82 · Note
• https://github.com/SickChill/sickchill/blob/846adafdfab579281353ea08a27bbb813f9a9872/sickchill/views/authentication.py#L33 · Note
• https://t.me/cvedetector/14740 · Telegram Post
• https://securitylab.github.com/advisories/GHSL-2024-283_GHSL-2024-291_sickchill_sickchill · Note
• https://twitter.com/CVEnew/status/1877101372304167302 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/1994712908694257821 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1877138800943489230 · Twitter Post