Debian DSA-6544-1: SABnzbd+ Web UI Code Execution and Authorization Bypass — Detection and Remediation Guide

---
title: SABnzbd+ Spawning Shell or Interpreter Child Process
id: 3f8a2c41-9b7e-4d15-a6c2-8e1f5b9d3a07
status: experimental
description: Detects the SABnzbd+ service process spawning shells, interpreters, or download tooling, consistent with post-exploitation command execution via the web UI code execution flaw (Debian DSA-6544-1).
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6544-1-sabnzbdplus
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/SABnzbd.py'
      - '/sabnzbdplus'
      - '/python3'
  selection_parent_cmd:
    ParentCommandLine|contains:
      - 'SABnzbd.py'
      - 'sabnzbdplus'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
      - '/base64'
      - '/chmod'
      - '/chown'
      - '/useradd'
      - '/crontab'
  condition: selection_parent and selection_parent_cmd and selection_child
falsepositives:
  - Legitimate administrator-configured post-processing scripts invoking shells; review script paths under the SABnzbd scripts directory to baseline
level: high
---
title: SABnzbd.exe Spawning Command Interpreter on Windows
id: 6c1d9e72-4a3b-4f08-b2d5-7c9e1a4f6b23
status: experimental
description: Detects the SABnzbd+ Windows process spawning command interpreters or scripting engines, consistent with command execution via the web UI (Debian DSA-6544-1 class of flaw applies cross-platform).
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6544-1-sabnzbdplus
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\SABnzbd.exe'
      - '\SABnzbd-service.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Post-processing scripts legitimately invoked by SABnzbd categories; baseline known script names and paths
level: high
---
title: External Network Connection to SABnzbd+ Web UI Port
id: 9e4b7d15-2f6a-4c81-8a3d-1b5e7c9f2a48
status: experimental
description: Detects inbound network connections to the default SABnzbd+ web UI ports from non-loopback sources, identifying unintended exposure of the management interface relevant to DSA-6544-1 exploitation.
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6544-1-sabnzbdplus
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
  product: linux
detection:
  selection_port:
    DestinationPort:
      - 8080
      - 9090
  selection_process:
    Image|endswith:
      - '/python3'
      - '/sabnzbdplus'
  filter_loopback:
    DestinationIp|startswith:
      - '127.'
      - '::1'
  condition: selection_port and selection_process and not filter_loopback
falsepositives:
  - Legitimate remote administration from trusted LAN hosts; restrict by allowlisting known management subnets in a tuning filter
level: medium

// Hunt 1: SABnzbd+ spawning suspicious child processes (MDE Linux/Windows)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any ("SABnzbd", "sabnzbdplus")
   or InitiatingProcessCommandLine has_any ("SABnzbd.py", "sabnzbdplus")
| where FileName in~ ("bash", "sh", "dash", "zsh", "curl", "wget", "nc", "ncat", "socat", "base64", "cmd.exe", "powershell.exe", "pwsh.exe")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessRemoteSessionIP
| order by TimeGenerated desc;

// Hunt 2: Syslog - shell activity under the sabnzbd service account and auth events on the host
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_any ("sabnzbd", "SABnzbd")
   and (SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl", "wget", "nc -", "base64 -d", "chmod +x")
        or SyslogMessage has_any ("authentication failure", "session opened"))
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;

// Hunt 3: Network exposure check - devices listening or accepting connections on SABnzbd ports
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where LocalPort in (8080, 9090)
   and (InitiatingProcessFileName has_any ("SABnzbd", "python") or FileName has_any ("SABnzbd", "python"))
| where RemoteIP !startswith "127." and RemoteIP != "::1"
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, RemoteIP, RemotePort, LocalPort
| order by ConnectionCount desc

-- Triage SABnzbd+ hosts: identify the service, its listeners, and suspicious child processes
LET procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)sabnzbd'

LET listeners = SELECT Lfd, Pid, Name, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE LocalPort IN (8080, 9090) AND Status = 'LISTEN'

SELECT 'service_process' AS Finding, Pid, Ppid, Name, CommandLine, Username,
       NULL AS LocalAddress, NULL AS LocalPort, NULL AS Status
FROM procs
UNION ALL
SELECT 'listening_socket' AS Finding, Pid, NULL AS Ppid, Name, NULL AS CommandLine, NULL AS Username,
       LocalAddress, LocalPort, Status
FROM listeners
UNION ALL
SELECT 'suspicious_child' AS Finding, Pid, Ppid, Name, CommandLine, Username,
       NULL AS LocalAddress, NULL AS LocalPort, NULL AS Status
FROM pslist()
WHERE Ppid IN (SELECT Pid FROM procs)
  AND Name =~ '(?i)^(bash|sh|dash|zsh|curl|wget|nc|ncat|socat|base64)$'

#!/usr/bin/env bash
# DSA-6544-1 remediation: patch, verify, and harden SABnzbd+ on Debian 13 (trixie)
set -euo pipefail

FIXED_VERSION="4.5.0+dfsg-1+deb13u2"

echo "[*] Updating package index and upgrading sabnzbdplus..."
apt-get update -qq
apt-get install -y --only-upgrade sabnzbdplus

echo "[*] Verifying installed version..."
INSTALLED=$(dpkg-query -W -f='${Version}' sabnzbdplus 2>/dev/null || echo "not-installed")
echo "    Installed: ${INSTALLED}"
if [ "$INSTALLED" = "not-installed" ]; then
  echo "[!] sabnzbdplus is not installed on this host. Nothing further to do."
  exit 0
fi
if dpkg --compare-versions "$INSTALLED" lt "$FIXED_VERSION"; then
  echo "[FAIL] Installed version ${INSTALLED} is OLDER than fixed ${FIXED_VERSION}. Investigate mirror/pin configuration."
  exit 1
fi
echo "[OK] Version ${INSTALLED} meets or exceeds the fixed release."

echo "[*] Restarting service to load patched code..."
systemctl restart sabnzbdplus 2>/dev/null || systemctl --user restart sabnzbd 2>/dev/null || echo "[!] Restart manually if not managed by systemd."

echo "[*] Checking web UI bind address exposure..."
for PID in $(pgrep -f -i sabnzbd || true); do
  ss -lntp 2>/dev/null | grep -E ':(8080|9090)' | grep -E '0\.0\.0\.0|::' && \
    echo "[WARN] SABnzbd web UI is listening on ALL interfaces. Restrict exposure (see hardening steps below)."
done

CONFIG=$(find /etc /home /var/lib -maxdepth 4 -name 'sabnzbd.ini' 2>/dev/null | head -n 1 || true)
if [ -n "$CONFIG" ]; then
  echo "[*] Found config: ${CONFIG}"
  grep -qE '^host\s*=\s*(127\.0\.0\.1|localhost)' "$CONFIG" \
    && echo "[OK] Web UI bound to loopback." \
    || echo "[WARN] 'host' is not loopback in ${CONFIG}. Set host = 127.0.0.1 unless remote access is strictly required."
  grep -qE '^username\s*=\s*\S+' "$CONFIG" \
    && echo "[OK] Web UI authentication appears configured." \
    || echo "[WARN] No web UI username set. Enable authentication immediately (Config > General)."
else
  echo "[!] sabnzbd.ini not found in standard locations; review bind/auth settings manually."
fi

echo "[*] Applying firewall restriction for ports 8080/9090 (loopback + RFC1918 only)..."
if command -v ufw >/dev/null 2>&1; then
  ufw deny 8080/tcp >/dev/null 2>&1 || true
  ufw deny 9090/tcp >/dev/null 2>&1 || true
  echo "[OK] UFW deny rules added for 8080/9090. Add explicit allows for trusted management subnets."
else
  echo "[!] UFW not present; apply equivalent nftables/iptables rules manually."
fi

echo "[*] Remediation complete. Re-run version check after any future package operations."