Remote code execution via specially crafted script settings in SABnzbd

CVE-2023-34237

What is CVE-2023-34237?

A design flaw in SABnzbd, an open-source Usenet download client, enables remote code execution due to unsafe handling of parameters in the Notification Script functionality. This vulnerability allows attackers to execute malicious code with the privileges of the running SABnzbd process, should they gain access to the web interface. The potential for exploitation is heightened when users expose their instances to the internet without proper authentication. To mitigate risks, upgrading to version 4.0.2 or later is recommended, along with securing web interface access with a username and password. For users unable to upgrade, ensuring proper authentication settings is crucial to safeguarding their installations.

References