CVE-2023-50258 Blind SSRF in `/home/testdiscord` endpoint
Unauthenticated attackers can trigger blind SSRF via the testDiscord endpoint, allowing them to craft POST requests from the Medusa server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-50258?
CVE-2023-50258 is a medium-severity server-side request forgery vulnerability in pymedusa Medusa, published on 22 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery (SSRF). The `testDiscord` request handler in `medusa/server/web/home/handler.py` does not validate the user-controlled `discord_webhook` variable and passes it to the `notifiers.discord_notifier.test_notify` method, then `_notify_discord` and finally `_send_discord_msg` method, which sends a POST request to the user-controlled URL on line 64 in `/medusa/notifiers/discord.py`, which leads to a blind server-side request forgery. This issue allows for crafting POST requests on behalf of the Medusa server. Version 1.0.19 contains a fix for the issue.
Weakness: CWE-918
Which versions are affected by CVE-2023-50258?
It affects 1 product.
Products include Pymedusa Medusa.
How do I fix CVE-2023-50258?
No fix has been published for CVE-2023-50258 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2023-50258 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-50258 exists.
Other vulnerabilities in pymedusa Medusa
Sources
Also known as GHSA-3hph-6586-qv9g.