PT-2024-30669 · Jellyfin · Jellyfin

Itz-D0Dgy

+1

·

Published

2024-09-02

·

Updated

2024-10-01

·

CVE-2024-43801

CVSS v3.1

4.6

Medium

VectorAV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Jellyfin versions prior to 10.9.10
Description The Jellyfin user profile image upload accepts SVG files, allowing for a stored XSS attack against an admin user via a specially crafted malicious SVG file. When viewed by an admin outside of the Jellyfin Web UI, this malicious SVG file could interact with the browser's LocalStorage and retrieve an AccessToken, which in turn can be used in an API call to elevate the target user to a Jellyfin administrator. The actual attack vector is unlikely to be exploited, as it requires specific actions by the administrator to view the SVG image outside of Jellyfin's WebUI.
Recommendations For versions prior to 10.9.10, upgrade to release version 10.9.10 to resolve the issue. As a temporary workaround, consider disabling the upload of SVG files for user profiles until the patch is applied. Restrict access to the user profile image upload feature to minimize the risk of exploitation. Avoid viewing user profile images outside of the Jellyfin Web UI to prevent potential interaction with the browser's LocalStorage.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-43801
GHSA-VCMH-9WX9-RFQH

Affected Products

Jellyfin