CVE-2021-29490

MEDIUMNuclei

Unauthenticated GET requests through Remote Image endpoints

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-29490 has a selected CVSS score of 5.8 (medium); EIP currently links 1 Nuclei template.

Description

Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to 10.7.3 vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter. This issue potentially exposes both internal and external HTTP servers or other resources available via HTTP `GET` that are visible from the Jellyfin server. The vulnerability is patched in version 10.7.3. As a workaround, disable external access to the API endpoints `/Items/*/RemoteImages/Download`, `/Items/RemoteSearch/Image` and `/Images/Remote` via reverse proxy, or limit to known-friendly IPs.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

jellyfin

Browse jellyfin / jellyfin
CVE List<= 10.7.2affected

Nuclei templates

1
ProjectDiscoveryMEDIUMJellyfin 10.7.2 - Server Side Request ForgeryCVSS 5.8

Jellyfin is a free software media system. Versions 10.7.2 and below are vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter.

Impact

This vulnerability can lead to unauthorized access to internal resources, potential data leakage, and further exploitation of the target system.

Remediation

Upgrade to version 10.7.3 or newer. As a workaround, disable external access to the API endpoints "/Items/*/RemoteImages/Download", "/Items/RemoteSearch/Image" and "/Images/Remote".

WeaknessesCWE-918
Authorsalph4byt3
Template tagscvecve2021ssrfjellyfinoastvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CPE: cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:*
Shodan: http.title:"Jellyfin"
FOFA: body="jellyfin"
Google: intitle:"jellyfin"
https://github.com/jellyfin/jellyfin/security/advisories/GHSA-rgjw-4fwc-9v96 https://nvd.nist.gov/vuln/detail/CVE-2021-29490 https://github.com/ARPSyndicate/kenzer-templates https://github.com/HimmelAward/Goby_POC https://github.com/Threekiii/Awesome-POC

Source: ProjectDiscovery

References

1