CVE-2023-50266 Bazarr Blind Server-Side Request Forgery (SSRF) in the /test/<protocol>/ endpoint
Attackers can exploit unvalidated input in the test endpoint to force the server to make arbitrary GET requests, potentially accessing internal resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-50266?
CVE-2023-50266 is a medium-severity server-side request forgery vulnerability in morpheus65535 bazarr, published on 15 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get() without any sanitization, which leads to a blind server-side request forgery (SSRF). This issue allows for crafting GET requests to internal and external resources on behalf of the server. 1.3.1 contains a partial fix, which limits the vulnerability to HTTP/HTTPS protocols.
Weakness: CWE-918
Which versions are affected by CVE-2023-50266?
It affects 1 product.
Products include Bazarr Bazarr.
How do I fix CVE-2023-50266?
No fix has been published for CVE-2023-50266 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2023-50266 being exploited?
There is no known exploitation of CVE-2023-50266 in the wild and no public exploit code.