Talebook
Monthly
Authenticated remote code execution affects Talebook (MyBooks/PoxenStudio) ebook management server versions 3.41.2 and earlier, where an administrator can inject arbitrary Python into the auto-generated auto.py settings module via a crafted SOCIAL_AUTH key name. Because the server imports auto.py as a live module and can auto-restart to reload it, injected statements execute with the service account's privileges, enabling data disclosure, file modification, persistence, or service disruption. No public exploit is identified at time of analysis; the fix is version 3.42.0, and chained authorization/registration weaknesses noted by the vendor could lower the effective privilege barrier.
Registration bypass and authentication bypass in Talebook (MyBooks) 3.41.2 and earlier allow an unauthenticated remote attacker to create accounts on instances where the administrator has disabled public registration, and then immediately authenticate with those unactivated accounts to access user-level API functionality. The root cause is a server-side enforcement gap: the POST /api/user/sign_up handler in user.py ignores the ALLOW_REGISTER configuration flag entirely, relying on the frontend to suppress the UI - a classic CWE-602 client-side enforcement failure. A second flaw in process_auth_header (base.py) compounds the issue by skipping verification of the account active flag, so the freshly created account can authenticate without email confirmation. No public exploit code or CISA KEV listing has been identified at time of analysis. The issue is fixed in version 3.42.0.
Missing authorization in MyBooks (Talebook) 3.41.2 and earlier allows any authenticated low-privilege user - including holders of unactivated accounts - to overwrite server-side configuration through the POST /api/admin/settings endpoint, exposing SMTP credentials, OAuth client secrets, storage paths, and security feature flags to unauthorized modification. Two compounding flaws are present: the AdminSettings.post handler in webserver/handlers/admin.py applies only the authentication decorator without the admin_user check enforced by its GET counterpart, and process_auth_header in webserver/handlers/base.py accepts sessions for registered-but-unactivated accounts by not verifying the user.active flag. No active exploitation has been confirmed (not in CISA KEV), but the fix is available in version 3.42.0.
Authenticated remote code execution affects Talebook (MyBooks/PoxenStudio) ebook management server versions 3.41.2 and earlier, where an administrator can inject arbitrary Python into the auto-generated auto.py settings module via a crafted SOCIAL_AUTH key name. Because the server imports auto.py as a live module and can auto-restart to reload it, injected statements execute with the service account's privileges, enabling data disclosure, file modification, persistence, or service disruption. No public exploit is identified at time of analysis; the fix is version 3.42.0, and chained authorization/registration weaknesses noted by the vendor could lower the effective privilege barrier.
Registration bypass and authentication bypass in Talebook (MyBooks) 3.41.2 and earlier allow an unauthenticated remote attacker to create accounts on instances where the administrator has disabled public registration, and then immediately authenticate with those unactivated accounts to access user-level API functionality. The root cause is a server-side enforcement gap: the POST /api/user/sign_up handler in user.py ignores the ALLOW_REGISTER configuration flag entirely, relying on the frontend to suppress the UI - a classic CWE-602 client-side enforcement failure. A second flaw in process_auth_header (base.py) compounds the issue by skipping verification of the account active flag, so the freshly created account can authenticate without email confirmation. No public exploit code or CISA KEV listing has been identified at time of analysis. The issue is fixed in version 3.42.0.
Missing authorization in MyBooks (Talebook) 3.41.2 and earlier allows any authenticated low-privilege user - including holders of unactivated accounts - to overwrite server-side configuration through the POST /api/admin/settings endpoint, exposing SMTP credentials, OAuth client secrets, storage paths, and security feature flags to unauthorized modification. Two compounding flaws are present: the AdminSettings.post handler in webserver/handlers/admin.py applies only the authentication decorator without the admin_user check enforced by its GET counterpart, and process_auth_header in webserver/handlers/base.py accepts sessions for registered-but-unactivated accounts by not verifying the user.active flag. No active exploitation has been confirmed (not in CISA KEV), but the fix is available in version 3.42.0.