Unauthenticated API Bypass Exposes Audiobookshelf Servers to Unauthorized Access

Summary

Audiobookshelf users face a critical security flaw that allows attackers to bypass authentication or crash servers by exploiting unanchored regex patterns in URLs. The issue affects versions 2.17.0 through 2.19.0 of the software, with a patch available in version 2.19.1. Rapid7 has responded by adding a detection module to Metasploit Framework, aiding defenders in identifying and mitigating this vulnerability.

What Happened

Audiobookshelf, a self-hosted audiobook server, is susceptible to an unauthenticated API authentication bypass due to flawed regex pattern handling. Attackers can craft specific URLs that exploit these patterns to either bypass authentication or trigger server crashes. This vulnerability arises from the use of unanchored regexes in the Auth.js middleware, which allows attackers to append query parameters containing vulnerable substrings.

Technical Details

The root cause lies in how Audiobookshelf's authentication middleware processes requests. The authNotNeeded function uses unanchored regex patterns to decide if a request can bypass authentication. By appending specific substrings to the query string of a URL, attackers can trick the system into thinking that authentication is not required for certain protected endpoints.

This flaw can lead to two primary issues:

1. Information Disclosure: Attackers can access data without proper user context by exploiting unprotected endpoints.
2. Denial of Service (DoS): Certain requests can crash the server if they reference undefined properties in the request object, such as req.user.

The vulnerability was introduced with a specific commit on November 3, 2024, and affects any Audiobookshelf instance running versions from 2.17.0 to 2.19.0.

Affected Products and Fixed Versions

The vulnerability is resolved in version 2.19.1, where the regex patterns are anchored to prevent exploitation.

Exploitation Status

The vulnerability has been actively exploited, as evidenced by the development of a detection module within Metasploit Framework. This indicates that attackers have likely leveraged this flaw in real-world scenarios.

Detection Opportunities

Rapid7 has introduced a new detection module in Metasploit Framework to identify vulnerable Audiobookshelf instances. The module performs differential checks against endpoints like /api/libraries to confirm the presence of the vulnerability.

use auxiliary/scanner/http/audiobookshelf_auth_bypass
run -r 13378

This command can be used to scan a server running on port 13378 for the vulnerability. A successful detection will confirm the unauthenticated API authentication bypass.

Defender Guidance

Defenders should:

1. Update Audiobookshelf: Immediately upgrade to version 2.19.1 or later to patch the vulnerability.
2. Deploy Detection Module: Use the Metasploit Framework's new module to scan for vulnerable instances within your network.
3. Monitor Logs: Keep an eye on server logs for unusual access patterns that might indicate exploitation attempts.

What Remains Unclear

While the detection module provides a means to identify vulnerable servers, it remains unclear how widespread the exploitation of this vulnerability is in the wild. Additionally, there may be other affected endpoints not covered by the current detection logic.

By following these steps, defenders can mitigate the risk posed by this critical vulnerability and protect their Audiobookshelf instances from potential attacks.