CVE-2021-25926: Cross-site scripting in sickrage
Summary
CVE-2021-25926: Cross-site scripting in sickrage. Affects sickrage versions >= 9.3.54, < 10.0.11.dev2. Fixed in 10.0.11.dev2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Sickrage is an open-source application used for managing and downloading TV show episodes. It provides a user-friendly interface for searching and organizing TV shows. However, versions 9.3.54.dev1 to 10.0.11.dev1 of Sickrage are vulnerable to a Reflected Cross-Site Scripting (XSS) attack. This vulnerability arises due to improper validation of user input in the 'quicksearch' feature. As a result, an attacker can exploit this vulnerability to steal a user's sessionID and impersonate them, potentially carrying out malicious actions on their behalf.
Vulnerability Detail
The vulnerability in Sickrage allows an attacker to inject malicious scripts into the application, which are then executed in the context of the victim user's session. By tricking a user into clicking on a specially crafted link, the attacker can exploit this vulnerability and gain unauthorized access to the victim's session. This can lead to various consequences, such as unauthorized actions performed on behalf of the victim, data theft, or even complete compromise of the user's account.
How To Fix
Minimum fixed version
10.0.11.dev2
This is the first release that contains the fix.
pip install --upgrade "sickrage==10.0.11.dev2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the 'quicksearch' feature in Sickrage. This can be done by modifying the application's configuration settings or by disabling the corresponding functionality through the user interface. By disabling this feature, the risk of exploitation through XSS attacks is mitigated. However, it is still advisable to update to the latest version as soon as possible.
Conclusion
In conclusion, Sickrage versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to a Reflected Cross-Site Scripting (XSS) attack. This vulnerability can be exploited by an attacker to steal a user's sessionID and carry out unauthorized actions on their behalf. To mitigate this risk, it is crucial to update Sickrage to version 10.0.11 or later. Additionally, users can temporarily disable the 'quicksearch' feature as a workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sickrage →
FAQ
Sickrage is an open-source application used for managing and downloading TV show episodes. It provides a user-friendly interface for searching and organizing TV shows.
Reflected Cross-Site Scripting (XSS) is a type of security vulnerability that allows an attacker to inject malicious scripts into web pages viewed by users. These scripts are then executed in the context of the victim user's session, potentially leading to unauthorized actions or data theft.
An attacker can exploit this vulnerability by tricking a user into clicking on a specially crafted link. This link contains the malicious script that is then executed in the victim user's session, allowing the attacker to steal their sessionID and carry out actions on their behalf.
The consequences of this vulnerability include unauthorized actions performed on behalf of the victim user, data theft, and potential compromise of the user's account.
To protect yourself from this vulnerability, it is recommended to update Sickrage to version 10.0.11 or later. Additionally, exercise caution when clicking on links from untrusted sources and consider disabling the 'quicksearch' feature as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for sickrage.
