CVE-2023-51665: 
NixOS vulnerability analysis and mitigation

Audiobookshelf, a self-hosted audiobook and podcast server, was found to contain an unauthenticated blind server-side request forgery (SSRF) vulnerability in Auth.js prior to version 2.7.0. The vulnerability was discovered and reported by GHSL team member Sylwia Budzynska and was assigned CVE-2023-51665 (GitHub Advisory).

The vulnerability exists in the /auth/openid/config endpoint which takes a user-controlled req.query.issuer GET parameter and uses it to send a GET request, leading to an unauthenticated server-side request forgery. The response of the request is not reflected back to the user, making it a blind SSRF vulnerability. The issue was found with the help of CodeQL's Server-side request forgery query (SecurityLab).

This vulnerability allows attackers to craft GET requests on behalf of the audiobookshelf server, potentially enabling them to interact with internal services or perform network reconnaissance (SecurityLab).

The vulnerability has been patched in version 2.7.0. The fix includes requiring admin user authentication and validating the issuer URL before making the request (GitHub Commit). Users are advised to upgrade to version 2.7.0 or later to address this security issue.