Skip to content

Instantly share code, notes, and snippets.

@b33t1e
Created March 30, 2023 02:51
Show Gist options
  • Save b33t1e/5c067e0538a0b712dc3d59bd4b9a5952 to your computer and use it in GitHub Desktop.
Save b33t1e/5c067e0538a0b712dc3d59bd4b9a5952 to your computer and use it in GitHub Desktop.
[description]
Jellyfin up to v10.7.7 was discovered to contain a Server-Side Request
Forgery (SSRF) via the component /Repositories. This vulnerability
allows attackers to access network resources and sensitive information
via a crafted POST request.
>
------------------------------------------
>
[VulnerabilityType Other]
Server-Side Request Forgery (SSRF)
>
------------------------------------------
>
[Vendor of Product]
https://github.com/jellyfin/jellyfin
>
------------------------------------------
>
[Affected Product Code Base]
jellyfin - <= Version 10.7.7
>
------------------------------------------
>
[Affected Component]
The API endpoints /Repositories are vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the url parameter.
>
------------------------------------------
>
[Attack Type]
Remote
>
------------------------------------------
>
[Impact Escalation of Privileges]
true
>
------------------------------------------
>
[Impact Information Disclosure]
true
>
------------------------------------------
>
[Attack Vectors]
POC: POST /Repositories API with payload [{"Name":"Jellyfin Stable","Url":"http://127.0.0.1:2233/ssrf_test?param=1&param2=3","Enabled":true}]
details can be seen: https://notes.sjtu.edu.cn/s/yJ9lPk09a
>
------------------------------------------
>
[Discoverer]
beet1e
>
------------------------------------------
>
[Reference]
http://jellyfin.com
https://github.com/jellyfin/jellyfin
https://notes.sjtu.edu.cn/s/yJ9lPk09a
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment