Podgrab Missing Authentication in WebSocket Route

Executive Summary

Podgrab has a missing authentication vulnerability where the /ws WebSocket route is not properly protected. Instead of being on a BasicAuth-protected router, it is on the root engine, allowing unauthenticated connections even when a password is set. Attackers can join the connection pool, capture player identifiers from broadcasts, and replay them to hijack queue payloads meant for authenticated users.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthenticated connections to the /ws WebSocket endpoint. Use tools like tcpdump or Wireshark to capture traffic on the expected port and inspect for connections to /ws without prior authentication. Check server logs for unusual PlayerExists broadcasts or RegisterPlayer messages from unknown clients.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to intercept sensitive data like episode IDs, titles, and file paths. It can also disrupt playback for legitimate users by hijacking their queue payloads. Unauthorized access to the WebSocket endpoint may lead to data exposure or service disruption.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Podgrab to the latest version where the /ws route is properly protected by BasicAuth. If an update is unavailable, restrict access to the /ws endpoint via firewall rules or reverse proxy configurations to allow only trusted IPs. Disable the WebSocket service if not essential.

Useful 0 Not Useful 0