sabnzbd-unauth-access: SABnzbd - Unauthenticated Web Interface Access

id: sabnzbd-unauth-access

info:
  name: SABnzbd - Unauthenticated Web Interface Access
  author: 0x_Akoko
  severity: high
  description: |
   Detected SABnzbd found with the web interface accessible without authentication. The config page is exposed without login, leaking the API key, config file path, server parameters, and system information to unauthenticated users.
  reference:
    - https://sabnzbd.org/wiki/extra/access-denied.html
    - https://sabnzbd.org/wiki/configuration/4.5/api
  classification:
    cwe-id: CWE-306
  metadata:
    max-request: 1
    verified: true
    shodan-query: http.title:"SABnzbd"
    fofa-query: title="SABnzbd"
  tags: sabnzbd,unauth,misconfig,exposure,iot

http:
  - method: GET
    path:
      - "{{BaseURL}}/config/"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "var sabSession =", "configTranslate", "SABnzbd Config")'
          - 'contains(content_type, "text/html")'
        condition: and
# digest: 4a0a004730450220468613bb79b5633b1acac526b62e91483a25d5c543ee7d589544b9e68306000b022100f1c9c24379d9d0296f1fef17c13c36e0727c08cb76afafed694e8cbd165cc3a8:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.