Add Audiobookshelf authentication bypass scanner (CVE-2025-25205)

[kenlacroix]

Summary

Adds auxiliary/scanner/http/audiobookshelf_auth_bypass, a detection module for
CVE-2025-25205 —
an unauthenticated API authentication bypass in Audiobookshelf
(self-hosted audiobook/podcast server), affecting versions 2.17.0 – 2.19.0 (fixed in 2.19.1).

Vulnerability

The auth middleware (server/Auth.js) decides whether a GET may skip authentication by testing
unanchored regexes (/\/api\/items\/[^/]+\/cover/, /\/api\/authors\/[^/]+\/image/) against
req.originalUrl — which includes the query string — instead of the normalized req.path. Appending
a query value containing one of those substrings (e.g. /api/libraries?r=/api/items/1/cover) satisfies
the "auth not needed" check while Express still routes the request to the protected handler. Fixed in
2.19.1 by anchoring the patterns and matching req.path.

What the module does

1. Fingerprints the server and version via the unauthenticated /status endpoint.
2. Performs a differential check against /api/libraries: a baseline request that a server normally
   rejects with 401, and a bypass request carrying the whitelisted substring. On a vulnerable server
   the bypass is processed instead of rejected (HTTP 200, or 500 because the handler runs without a
   user object); a patched server returns 401 to both.

It intentionally targets /api/libraries and avoids endpoints such as /api/users that crash the
server process (the DoS half of this CVE), so the check is crash-safe.

Verification

Tested against the official image at both a vulnerable and a patched tag (true-positive and
true-negative):

docker run -d -p 13378:80 ghcr.io/advplyr/audiobookshelf:2.19.0   # vulnerable
docker run -d -p 13379:80 ghcr.io/advplyr/audiobookshelf:2.19.1   # patched

msf6 auxiliary(scanner/http/audiobookshelf_auth_bypass) > set RPORT 13378
msf6 auxiliary(scanner/http/audiobookshelf_auth_bypass) > run
[+] 127.0.0.1:13378       - Audiobookshelf 2.19.0 - unauthenticated API authentication bypass confirmed (CVE-2025-25205)
[*] Auxiliary module execution completed

msf6 auxiliary(scanner/http/audiobookshelf_auth_bypass) > set RPORT 13379
msf6 auxiliary(scanner/http/audiobookshelf_auth_bypass) > run
[*] 127.0.0.1:13379       - Audiobookshelf 2.19.1 - not vulnerable (authentication enforced)
[*] Auxiliary module execution completed

Documentation with full setup and scenarios is included at
documentation/modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.md.

Verification Steps

1. Start a vulnerable Audiobookshelf instance and complete the initial root-user setup
2. use auxiliary/scanner/http/audiobookshelf_auth_bypass
3. set RHOSTS <target>
4. set RPORT 13378
5. run — the module reports the version and confirms the bypass