Skip to main content

Server-Side Request Forgery (SSRF)

CVE-2021-29490

Medium
5.8/10

Summary

Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. In versions prior to 10.7.3 are vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the "imageUrl" parameter. This issue potentially exposes both internal and external HTTP servers or other resources available via HTTP `GET` that are visible from the Jellyfin server. As a workaround, disable external access to the API endpoints `/Items/*/RemoteImages/Download`, `/Items/RemoteSearch/Image`, and `/Images/Remote` via a reverse proxy or limit to known-friendly IPs.

  • LOW
  • NETWORK
  • NONE
  • CHANGED
  • NONE
  • NONE
  • LOW
  • NONE

CWE-918 - Server-Side Request Forgery (SSRF)

Server-side request forgery (SSRF) is a weakness that allows an attacker to send an arbitrary request, making it appear that the request was sent by the server. This request may bypass a firewall that would normally prevent direct access to the URL. The impact of this vulnerability can vary from unauthorized access to files and sensitive information to remote code execution.

References

Advisory Timeline

  • Published