CVE-2023-50264
📋 TL;DR
CVE-2023-50264 is an arbitrary file read vulnerability in Bazarr subtitle management software. Attackers can read any file on the system by manipulating the filename parameter in the backup download endpoint. All Bazarr users running versions before 1.3.1 are affected.
💻 Affected Systems
- Bazarr
📦 What is this software?
Bazarr by Bazarr
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through reading sensitive files like SSH keys, configuration files, or database credentials, potentially leading to lateral movement or data exfiltration.
Likely Case
Unauthorized access to sensitive configuration files, subtitle files, or other application data stored on the server.
If Mitigated
Limited impact if proper network segmentation and file permissions restrict access to sensitive system files.
🎯 Exploit Status
Exploitation requires authentication to the Bazarr web interface. The vulnerability is simple to exploit with basic web request manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.1
Vendor Advisory: https://github.com/morpheus65535/bazarr/releases/tag/v1.3.1
Restart Required: Yes
Instructions:
1. Stop Bazarr service. 2. Backup your configuration. 3. Update to version 1.3.1 via package manager, Docker pull, or manual installation. 4. Restart Bazarr service. 5. Verify the update was successful.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to Bazarr web interface to trusted IPs only
# Using firewall (example for Linux iptables)
iptables -A INPUT -p tcp --dport 6767 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 6767 -j DROP
Authentication Hardening
allImplement strong authentication and consider using reverse proxy with additional authentication
# Ensure strong password in Bazarr settings
# Configure reverse proxy (nginx example)
location / {
auth_basic "Restricted";
auth_basic_user_file /etc/nginx/.htpasswd;
proxy_pass http://localhost:6767;
}
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Bazarr from sensitive systems
- Enable detailed logging and monitoring for suspicious file access patterns
🔍 How to Verify
Check if Vulnerable:
Check Bazarr version in web interface Settings > System or run: grep 'version' /path/to/bazarr/data/config/config.iniCheck Version:
docker exec bazarr python -c "import bazarr; print(bazarr.__version__)" or check web interface Settings > SystemVerify Fix Applied:
Confirm version is 1.3.1 or higher in web interface or configuration file📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in /system/backup/download/ endpoint
- Requests with path traversal sequences (../) in filename parameter
- Access to files outside expected backup directory
Network Indicators:
- HTTP requests to /system/backup/download/ with suspicious filename parameters
- Unusual outbound data transfers following file read requests
SIEM Query:
source="bazarr.log" AND (uri_path="/system/backup/download/" AND filename CONTAINS "../")🔗 References
- https://github.com/morpheus65535/bazarr/commit/17add7fbb3ae1919a40d505470d499d46df9ae6b
- https://github.com/morpheus65535/bazarr/releases/tag/v1.3.1
- https://securitylab.github.com/advisories/GHSL-2023-192_GHSL-2023-194_bazarr/
- https://github.com/morpheus65535/bazarr/commit/17add7fbb3ae1919a40d505470d499d46df9ae6b
- https://github.com/morpheus65535/bazarr/releases/tag/v1.3.1
- https://securitylab.github.com/advisories/GHSL-2023-192_GHSL-2023-194_bazarr/
