CVE-2018-9160
📋 TL;DR
SickRage versions before 2018.03.09-1 expose user credentials in cleartext within HTTP responses, allowing attackers to intercept authentication data. This affects all SickRage users running vulnerable versions, particularly those with internet-facing instances.
💻 Affected Systems
- SickRage
📦 What is this software?
Sickrage by Sickrage
⚠️ Risk & Real-World Impact
Worst Case
Full credential compromise leading to unauthorized access, data theft, and potential system takeover if credentials are reused elsewhere.
Likely Case
Credential harvesting by attackers scanning for vulnerable instances, resulting in unauthorized SickRage access and potential media library manipulation.
If Mitigated
Limited impact with proper network segmentation and credential isolation, though credentials remain exposed in transit.
🎯 Exploit Status
Exploitation requires only network access to intercept HTTP traffic; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2018.03.09-1 and later
Vendor Advisory: https://github.com/SickRage/sickrage.github.io/blob/master/sickrage-news/CHANGES.md
Restart Required: Yes
Instructions:
1. Update SickRage to version 2018.03.09-1 or later. 2. Restart the SickRage service. 3. Verify credentials are no longer exposed in HTTP responses.
🔧 Temporary Workarounds
Network Isolation
linuxRestrict SickRage access to trusted networks only using firewall rules.
iptables -A INPUT -p tcp --dport 8081 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 8081 -j DROP
Reverse Proxy with SSL
allPlace SickRage behind a reverse proxy with SSL/TLS encryption to protect credentials in transit.
🧯 If You Can't Patch
- Isolate SickRage to internal network segments only
- Use unique credentials not shared with other systems
🔍 How to Verify
Check if Vulnerable:
Intercept HTTP traffic to SickRage port (default 8081) and check if credentials appear in cleartext in responses.Check Version:
Check SickRage web interface settings or run: grep -i version /path/to/sickrage/config.iniVerify Fix Applied:
After update, verify credentials no longer appear in HTTP responses using traffic inspection tools.📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts
- Multiple failed login attempts from new IPs
Network Indicators:
- Cleartext credential strings in HTTP traffic to SickRage port
SIEM Query:
source="*sickrage*" AND "password" OR "username" IN http_response🔗 References
- https://github.com/SickRage/SickRage/commit/8156a74a68aea930d1e1047baba8b115c3abfc44
- https://github.com/SickRage/sickrage.github.io/blob/master/sickrage-news/CHANGES.md
- https://www.exploit-db.com/exploits/44545/
- https://github.com/SickRage/SickRage/commit/8156a74a68aea930d1e1047baba8b115c3abfc44
- https://github.com/SickRage/sickrage.github.io/blob/master/sickrage-news/CHANGES.md
- https://www.exploit-db.com/exploits/44545/
