PT-2023-31054 · Jellyfin · Jellyfin
Mawalu
+1
·
Publicado
2023-12-06
·
Atualizado
2025-04-15
·
CVE-2023-49096
CVSS v3.1
7.7
Alta
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
Jellyfin versions prior to 10.8.13
Description
The issue concerns an argument injection in the VideosController, specifically the "/Videos//stream" and "/Videos//stream." endpoints, which are reachable by an unauthenticated user. Additional endpoints in the AudioController might also be vulnerable. To exploit this, an attacker must guess a random GUID,
itemId, making direct exploitation unlikely without an additional information leak. The videoCodec and audioCodec query parameters are vulnerable to argument injection, allowing an attacker to inject arguments into the FFmpeg command line. This could potentially enable overwriting an arbitrary file with malicious content.Recommendations
For versions prior to 10.8.13, upgrade to version 10.8.13 or later to address the vulnerability. As a temporary workaround, consider restricting access to the
/Videos/<itemId>/stream and /Videos/<itemId>/stream.<container> endpoints until the upgrade is possible. Additionally, limiting the use of query parameters such as videoCodec and audioCodec can help minimize the risk of exploitation.Exploit
Correção
Argument Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Jellyfin