CVE-2020-37284: Sickbeard build-507 Reflected XSS via testNaming pattern Parameter
Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming handler returns unescaped, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sickbeard instances through build 507 are exposed if an attacker can cause a victim to visit a crafted request to the /config/postProcessing/testNaming endpoint. The attacker does not need to authenticate, but successful script execution requires victim interaction.
What does an attacker need to exploit it?
An attacker needs to send or otherwise persuade a victim to open a GET request containing a malicious SVG onload payload in the pattern parameter. The vulnerable handler reflects that value without escaping it.
How can I determine whether my instance is affected?
Check whether the Sickbeard deployment is build 507 or earlier and whether /config/postProcessing/testNaming reflects the pattern parameter without HTML escaping. A vulnerable response may return supplied markup directly, allowing it to execute in the browser.