CVE-2023-47619

Executive Summary

CVE-2023-47617 is a critical vulnerability in Audiobookshelf, a self-hosted audiobook and podcast server. Versions 2.4.3 and prior contain chained flaws — Server-Side Request Forgery (SSRF) and Arbitrary File Read/Delete — that allow authenticated users with the "update" permission to read arbitrary files from the host filesystem, delete arbitrary files, and issue crafted GET requests to arbitrary URLs, capturing the responses. The vulnerability carries a CVSS score of 8.1 (High) and remains unpatched as of the time of writing, with no official fix or workaround available from the vendor. This issue leads to Information Disclosure and potential data destruction, affecting any self-hosted Audiobookshelf instance exposed to users holding elevated permissions.

Technical Analysis

The NVD description for CVE-2023-47617 identifies a composite vulnerability class: concurrent Server-Side Request Forgery (SSRF) combined with arbitrary file read and arbitrary file delete primitives. The affected component is the Audiobookshelf application, a self-hosted media server that manages audiobook and podcast libraries via a web interface.

Vulnerability Mechanism:

The core issue resides in functionality accessible to users possessing the "update" permission. According to the NVD description, three distinct primitives are exposed:

1. Arbitrary File Read — An authenticated user with update permission can retrieve the contents of arbitrary files on the underlying host operating system. This bypasses any intended sandboxing or path-restriction mechanisms designed to limit file access to audiobook/podcast media directories.

2. Arbitrary File Delete — The same privilege level allows deletion of arbitrary files on the host filesystem. This transforms the vulnerability from a confidentiality-only issue into an integrity and availability threat, as the attacker can remove application files, configuration files, or user data.

3. Server-Side Request Forgery (SSRF) — The user can force the Audiobookshelf server to issue a GET request to an attacker-specified URL and read the server's response. This allows the attacker to:

   • Scan internal network ranges inaccessible from the internet
   • Access cloud metadata endpoints (e.g., AWS EC2 instance metadata at 169.254.169.254)
   • Interact with internal services (databases, admin panels, monitoring systems)
   • Exfiltrate data by pointing the SSRF to attacker-controlled endpoints

Attack Surface:

The attack surface is the web-based management interface of Audiobookshelf. The vulnerability requires authentication and the "update" permission, meaning the attacker must already have a valid account or have compromised one with that role. This is a post-authentication flaw, but the damage potential escalates significantly because:

• The SSRF component can pivot into the internal network
• The file read/delete primitives grant host-level filesystem access

Code-Level Context:

Per the accuracy rules, the NVD description does not provide specific function names, endpoint paths, or parameter names. The vulnerability is likely rooted in how Audiobookshelf handles URL inputs — possibly during audiobook metadata fetching, podcast RSS feed ingestion, or cover art downloading — where a user-controlled URL is passed directly to an HTTP client without validation against SSRF vectors. Similarly, file paths supplied by users with update permission are likely not validated against directory traversal or absolute path restrictions.

CVSS Rationale (Score: 8.1):

• Attack Vector: Network — Exploitable remotely over the network
• Attack Complexity: High — Requires valid credentials with update permission
• Privileges Required: Low — The permission is a non-admin user role
• User Interaction: None — No victim interaction needed
• Confidentiality/Integrity/Availability Impact: High — Full file system read/write/delete and network pivot

Exploitation Scenarios

Prerequisites: An account on the Audiobookshelf instance with the "update" permission. The NVD description confirms this is the only requirement.

No public PoC is available; the attack chain below is inferred from the vulnerability class described in the NVD entry.

Step 1: Reconnaissance and Target Identification

The attacker locates exposed Audiobookshelf instances using search engines or SHODAN (common dorks: title:"Audiobookshelf"). They then authenticate using either:

• Legitimate credentials obtained through phishing, credential stuffing, or previous compromise
• Default credentials if the administrator failed to change them
• A compromised user account with the "update" role

Step 2: Triggering the SSRF/File Access Flaw

Once authenticated, the attacker navigates to the features exposed to users with update permission (e.g., podcast management, feed configuration, metadata updates). The attacker supplies a specially crafted URL or file path as input to the vulnerable functionality. Because the application does not sanitize or restrict these inputs, it processes them with the server's own privileges.

Step 3: Payload Execution

For Arbitrary File Read: The attacker supplies a file path such as /etc/passwd (or a relative traversal sequence like ../../../../etc/shadow) in a field that controls which file the server reads (e.g., a cover image path, metadata file path, or library configuration). The server reads the file and returns its contents in the HTTP response.

For Arbitrary File Delete: The attacker supplies a path to a critical file (e.g., /var/www/audiobookshelf/config.json, /etc/cron.d/backup) in a delete operation. The server removes the file, causing application malfunction or data loss.

For SSRF: The attacker submits a URL such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS metadata) or http://127.0.0.1:8080/admin (internal service). The server issues an outbound GET to that URL and returns the response body. This leaks internal service data, cloud credentials, or internal network topology.

Step 4: Post-Exploitation Impact

• Information Disclosure: Host file contents (including SSH keys, database credentials, application secrets) exposed to the attacker.
• Internal Network Pivot: SSRF allows the attacker to scan and interact with internal services, potentially discovering additional vulnerable applications or databases.
• Data Destruction: File delete primitive can be used to destroy the application, its configuration, or user data — causing denial of service.
• Lateral Movement: Read SSH private keys or database connection strings, then move laterally within the network.

Impact Assessment

Business Impact:

The vulnerability poses a High severity risk to organizations running Audiobookshelf as a self-hosted media server. The CVSS 8.1 score reflects the chained impact: full disclosure of host files, the ability to delete critical files, and the SSRF pivot into internal infrastructure.

Affected Systems: All Audiobookshelf deployments running version 2.4.3 or earlier. Given that Audiobookshelf is typically deployed on Linux-based servers (via Docker, npm, or bare metal) in home labs, small businesses, or educational environments, the blast radius extends to:

• The host operating system's sensitive files (/etc/shadow, SSH private keys, cloud credentials)
• Any services running on the internal network that the server can reach (via SSRF)
• The integrity of the Audiobookshelf data directory and application configuration

Blast Radius:

• Confidentiality (High): Host file read exposes secrets, PII, and configuration data.
• Integrity (High): Arbitrary file delete allows destructive actions.
• Availability (High): Deleting application or system files causes denial of service.
• Network Scope: SSRF allows access to internal services, expanding the attack surface beyond the Audiobookshelf host.

CISA KEV Status: Not present in the CISA Known Exploited Vulnerabilities catalog as of writing; EPSS score of 0.00607 (45.8th percentile) indicates low exploitation probability but accelerating interest.

Detection Guidance

Detecting exploitation of this vulnerability requires monitoring for abnormal server behavior: unexpected file access, outbound HTTP requests to non-media URLs, and file deletion events.

Sigma Rule

title: Audiobookshelf SSRF - Outbound Requests to Private IP Ranges
id: 4f8d3a2e-9c1b-4f6a-8d3e-2a1b4c5d6e7f
status: experimental
description: Detects Audiobookshelf server initiating outbound GET requests to private IP ranges or metadata services, indicating SSRF exploitation.
author: Valtersit Threat Intel
date: 2024/01/15
logsource:
    category: webserver
    product: audiobookshelf
detection:
    selection:
        cs-method: GET
        dst_ip:
            - 10.0.0.0/8
            - 172.16.0.0/12
            - 192.168.0.0/16
            - 169.254.169.254
    condition: selection
falsepositives:
    - Legitimate internal podcast feed fetching from private servers
    - Admin debugging network issues
level: high

YARA Rule

rule Audiobookshelf_SSRF_Exploit_Patterns
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects common SSRF payloads targeting Audiobookshelf"
        date = "2024-01-15"
        severity = "high"
    strings:
        $s1 = "169.254.169.254" ascii wide nocase
        $s2 = "file:///" ascii wide nocase
        $s3 = "../../" ascii wide
        $s4 = "/etc/passwd" ascii wide
        $s5 = "localhost:8080" ascii wide nocase
        $s6 = "127.0.0.1" ascii wide
    condition:
        any of ($s*)
}

Suricata IDS Rule

alert http any any -> $EXTERNAL_NET any (msg:"Audiobookshelf SSRF - Outbound GET to Private IP"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"169.254.169.254"; sid:20240001; rev:1; metadata:created_at 2024_01_15;)
alert http any any -> $EXTERNAL_NET any (msg:"Audiobookshelf Arbitrary File Read - Path Traversal"; flow:established,to_server; http.uri; content:"/etc/passwd"; sid:20240002; rev:1;)
alert http $HOME_NET any -> $PRIVATE_NETS any (msg:"Audiobookshelf SSRF - Internal Network Pivot"; flow:established,to_server; http.method; content:"GET"; sid:20240003; rev:1;)

Elastic Detection

sequence with maxspan=30s
  [ network where
    process.name : "node" and
    destination.ip : ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "169.254.169.254") and
    network.direction : "egress" ]
  [ file where
    process.name : "node" and
    event.action : ("delete", "read") and
    file.path : ("/etc/*", "/var/*") and
    not file.extension : ("mp3", "m4b", "aac", "opus") ]

Splunk SPL Query

index=main sourcetype=nginx:plus:access earliest=-7d
| where match(cs_uri_stem, "(?i)(file://|\.\./|/etc/passwd|169\.254\.169\.254)")
| stats count by src_ip, cs_uri_stem, status
| sort -count

| index=main sourcetype=linux_audit earliest=-7d
| where command IN ("rm", "unlink") AND (path="*" AND path LIKE "/etc/%")
| stats count by user, path, host

Wazuh OSSEC Rule

<group name="audiobookshelf,">
  <rule id="100201" level="12">
    <decoded_as>syslog</decoded_as>
    <field name="program_name">audiobookshelf</field>
    <match>169.254.169.254|file:///|/etc/passwd</match>
    <description>Audiobookshelf SSRF/File Read attempt detected</description>
    <group>ssrf,audit,</group>
  </rule>

  <rule id="100202" level="10">
    <decoded_as>syslog</decoded_as>
    <field name="program_name">audiobookshelf</field>
    <match>DELETE|unlink</match>
    <match>config.json|.env|*.db</match>
    <description>Audiobookshelf possible arbitrary file deletion</description>
    <group>file_deletion,audit,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source

As of the time of writing, the vendor (Audiobookshelf maintainers) has not released a patched version. No CVE fix commit has been identified, and no vendor advisory exists. The NVD entry confirms "no patches are available" as of publication.

1. Immediate Mitigations (until a patch is available)

• Restrict the "update" permission to only trusted administrators. Since the vulnerability requires this permission, limiting its assignment reduces the attack surface.
• Disable public access to the Audiobookshelf web interface; place it behind a VPN or firewall allowing only authorized IPs.
• Monitor and audit the application logs for suspicious URLs (private IP ranges), file path traversal, and file deletion events.
• Backup the application data and host configuration regularly to minimize the impact of arbitrary file deletion.
• Harden the host filesystem: Run Audiobookshelf as a non-root user; use containerization (Docker) with read-only root filesystem and mounted volumes restricted to media-only directories.
• Network isolation: Segment the Audiobookshelf server from critical internal services and cloud metadata endpoints. Use egress firewall rules to block outbound connections to metadata IPs (169.254.169.254) and internal ranges.

2. Patch/Upgrade Steps

• Monitor the official Audiobookshelf GitHub repository and release feed for a version newer than 2.4.3.
• When a fix is released, upgrade immediately following the standard upgrade procedure (e.g., Docker image pull, npm install, or system package update).
• Do not apply third-party or community-developed patches unless vetted and signed by the vendor.

3. Long-Term Hardening

• Review user roles and permission assignments; apply the principle of least privilege for all Audiobookshelf accounts.
• Implement a Web Application Firewall (WAF) with SSRF and path-traversal rulesets.
• Use Security Information and Event Management (SIEM) to correlate the detection rules above.
• If SSRF is a recurring concern, consider running Audiobookshelf in a network namespace or container with a deny-by-default egress policy.

References

1. NVD Entry: CVE-2023-47617 — NVD
2. Vendor Repository: Audiobookshelf on GitHub — Watch for security releases and advisories.
3. MITRE ATT&CK: T1190 — Exploit Public-Facing Application
4. CISA Known Exploited Vulnerabilities Catalog: CISA KEV — CVE-2023-47617 is not currently listed; monitor for updates.
5. EPSS Model: FIRST EPSS Scoring — CVE-2023-47617 has an EPSS score of 0.00607 (45.8th percentile).

Threat Actor Activity: No known exploit-in-the-wild campaigns or threat actor usage of CVE-2023-47617 has been publicly documented as of this writing. The absence of a patch combined with the low but non-zero EPSS score suggests opportunistic attackers may begin targeting this vulnerability once automated exploits circulate.