Executive brief
AutoBangumi, an automated tool for managing media downloads, contains a security flaw in its initial setup process. An unauthenticated attacker can use the application's setup page to trick the server into scanning the internal network or accessing private services that are not normally exposed to the internet. This could lead to the exposure of sensitive information about the internal network infrastructure or other private services running alongside the application.
Technical details
A server-side request forgery (SSRF) vulnerability exists in AutoBangumi versions prior to 3.2.8 due to insufficient validation of user-supplied host values in the 'POST /api/v1/setup/test-downloader' endpoint. During the initial setup window, an unauthenticated remote attacker can provide arbitrary URLs, causing the server to initiate HTTP GET requests to internal, loopback, or reserved IP addresses. The application further leaks information by echoing detailed connection-error messages back to the attacker, which can be used to confirm the presence and status of internal services. The vulnerability was addressed in version 3.2.8 by hardening the setup endpoints to validate URL schemes and suppressing detailed error messages in the API response.
Affected products
- EstrellaXD AutoBangumi < 3.2.8
Timeline
- 2026-06-09: disclosed: Initial security issue reported on GitHub
- 2026-07-02: patched: Fix committed and version 3.2.8 released
- 2026-07-02: advisory: CVE published to NVD