CVE-2024-35236 (JSON, published 2024-05-27T17:15Z)
Description: value: Audiobookshelf is a self-hosted audiobook and podcast server. Prior to version 2.10.0, opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Attacking a user with high privileges (upload, creation of libraries) can lead to remote code execution (RCE) in the worst case. This was tested on version 2.9.0 on Windows, but an arbitrary file write is powerful enough as is and should easily lead to RCE on Linux, too. Version 2.10.0 contains a patch for the vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/advplyr/audiobookshelf
Files changed:
client/components/modals/libraries/LibrarySettings.vue
client/components/readers/EpubReader.vue
client/store/libraries.js
client/strings/bg.json
client/strings/bn.json
client/strings/cs.json
client/strings/da.json
client/strings/de.json
client/strings/en-us.json
client/strings/es.json
client/strings/et.json
client/strings/fr.json
client/strings/gu.json
client/strings/he.json
client/strings/hi.json
client/strings/hr.json
client/strings/hu.json
client/strings/it.json
client/strings/lt.json
client/strings/nl.json
client/strings/no.json
client/strings/pl.json
client/strings/pt-br.json
client/strings/ru.json
client/strings/sv.json
client/strings/uk.json
client/strings/vi-vn.json
client/strings/zh-cn.json
client/strings/zh-tw.json
server/objects/settings/LibrarySettings.js
Commit message: Update:Disable epubs from running scripts by default, add library setting to enable it GHSA-7j99-76cj-q9pg


Vulnerable code:
</script>
        allowScriptedContent: true,
  getCurrentLibrary: state => {
    return state.libraries.find(lib => lib.id === state.currentLibraryId)
  getSortedLibraries: state => () => {
    return state.libraries.map(lib => ({ ...lib })).sort((a, b) => a.displayOrder - b.displayOrder)
  getLibraryProvider: state => libraryId => {
    var library = state.libraries.find(l => l.id === libraryId)
  getCollection: state => id => {
    return state.collections.find(c => c.id === id)
  getPlaylist: state => id => {
    return state.userPlaylists.find(p => p.id === id)
      if (lastCheck < 1000 * 5) { // 5 seconds
    var index = state.libraries.findIndex(a => a.id === library.id)
    state.libraries = state.libraries.filter(a => a.id !== library.id)
    var index = state.listeners.findIndex(l => l.id === listener.id)
    state.listeners = state.listeners.filter(l => l.id !== listenerId)
    state.filterData.series = state.filterData.series.filter(se => se.id !== seriesId)
        const indexOf = state.filterData.authors.findIndex(au => au.id === author.id)
          state.filterData.authors.sort((a, b) => (a.name || '').localeCompare((b.name || '')))
        const indexOf = state.filterData.series.findIndex(se => se.id === series.id)
          state.filterData.series.sort((a, b) => (a.name || '').localeCompare((b.name || '')))
    var index = state.collections.findIndex(c => c.id === collection.id)
    state.collections = state.collections.filter(c => c.id !== collection.id)
    const index = state.userPlaylists.findIndex(p => p.id === playlist.id)
    state.userPlaylists = state.userPlaylists.filter(p => p.id !== playlist.id)
}
module.exports = LibrarySettings

Fixed code:
    <div v-if="isBookLibrary" class="py-3">
      <div class="flex items-center">
        <ui-toggle-switch v-model="epubsAllowScriptedContent" @input="formUpdated" />
        <ui-tooltip :text="$strings.LabelSettingsEpubsAllowScriptedContentHelp">
          <p class="pl-4 text-base">
            {{ $strings.LabelSettingsEpubsAllowScriptedContent }}
            <span class="material-icons icon-text text-sm">info_outlined</span>
          </p>
        </ui-tooltip>
      </div>
    </div>
      epubsAllowScriptedContent: false,
          epubsAllowScriptedContent: !!this.epubsAllowScriptedContent,
      this.epubsAllowScriptedContent = !!this.librarySettings.epubsAllowScriptedContent
</script>
    allowScriptedContent() {
      return this.$store.getters['libraries/getLibraryEpubsAllowScriptedContent']
    },
        allowScriptedContent: this.allowScriptedContent,
  getCurrentLibrary: (state) => {
    return state.libraries.find((lib) => lib.id === state.currentLibraryId)
  getSortedLibraries: (state) => () => {
    return state.libraries.map((lib) => ({ ...lib })).sort((a, b) => a.displayOrder - b.displayOrder)
  getLibraryProvider: (state) => (libraryId) => {
    var library = state.libraries.find((l) => l.id === libraryId)
  getLibraryEpubsAllowScriptedContent: (state, getters) => {
    return !!getters.getCurrentLibrarySettings?.epubsAllowScriptedContent
  getCollection: (state) => (id) => {
    return state.collections.find((c) => c.id === id)
  },
  getPlaylist: (state) => (id) => {
    return state.userPlaylists.find((p) => p.id === id)
      if (lastCheck < 1000 * 5) {
        // 5 seconds
    var index = state.libraries.findIndex((a) => a.id === library.id)
    state.libraries = state.libraries.filter((a) => a.id !== library.id)
    var index = state.listeners.findIndex((l) => l.id === listener.id)
    state.listeners = state.listeners.filter((l) => l.id !== listenerId)
    state.filterData.series = state.filterData.series.filter((se) => se.id !== seriesId)
        const indexOf = state.filterData.authors.findIndex((au) => au.id === author.id)
          state.filterData.authors.sort((a, b) => (a.name || '').localeCompare(b.name || ''))
        const indexOf = state.filterData.series.findIndex((se) => se.id === series.id)
          state.filterData.series.sort((a, b) => (a.name || '').localeCompare(b.name || ''))
    var index = state.collections.findIndex((c) => c.id === collection.id)
    state.collections = state.collections.filter((c) => c.id !== collection.id)
    const index = state.userPlaylists.findIndex((p) => p.id === playlist.id)
    state.userPlaylists = state.userPlaylists.filter((p) => p.id !== playlist.id)
}
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
  "LabelSettingsEpubsAllowScriptedContent": "Allow scripted content in epubs",
  "LabelSettingsEpubsAllowScriptedContentHelp": "Allow epub files to execute scripts. It is recommended to keep this setting disabled unless you trust the source of the epub files.",
    this.epubsAllowScriptedContent = false
    this.epubsAllowScriptedContent = !!settings.epubsAllowScriptedContent
      epubsAllowScriptedContent: this.epubsAllowScriptedContent,
module.exports = LibrarySettings