This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: Jellyfin < 10.7.3 suffers from an SSRF vulnerability. ๐ **Consequences**: Attackers can expose internal/external HTTP servers and access resources normally hidden from users via HTTP GET requests.โฆ
๐ก๏ธ **Root Cause**: CWE-918 (Server-Side Request Forgery). ๐ฅ **Flaw**: The `imageUrl` parameter in `RemoteImageController.cs` is not properly validated.โฆ
๐ฆ **Vendor**: Jellyfin. ๐ **Affected Versions**: All versions **prior to 10.7.3**. โ **Fixed In**: Version 10.7.3 and above. ๐ **Component**: Media streaming server functionality.
Q4What can hackers do? (Privileges/Data)
๐ต๏ธ **Action**: Unauthenticated SSRF attacks. ๐ **Target**: Internal network services, cloud metadata endpoints, or external resources. ๐ **Data**: Can read content from HTTP servers that are not publicly accessible.โฆ
๐ **Auth**: None required! (Unauthenticated). ๐ฏ **Config**: Low complexity. ๐ **Threshold**: Very Low. Any user can trigger the vulnerability via the `imageUrl` parameter without logging in. โก Easy to exploit.
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ **PoC Available**: Yes. ๐ **Sources**: ProjectDiscovery Nuclei templates & Awesome-POC GitHub repo. ๐ **Wild Exploit**: Likely high due to simplicity and lack of auth. ๐งช Testable via standard SSRF payloads.
Q7How to self-check? (Features/Scanning)
๐ **Check**: Scan for Jellyfin instances. ๐งช **Test**: Send SSRF payloads via the `imageUrl` parameter in API requests. ๐ ๏ธ **Tools**: Use Nuclei templates (`CVE-2021-29490.yaml`) for automated detection.โฆ
โ **Fixed**: Yes. ๐ **Patch Date**: Published May 5, 2021. ๐ **Action**: Upgrade Jellyfin to **version 10.7.3 or later**. ๐ **Advisory**: See GitHub Security Advisory GHSA-rgjw-4fwc-9v96.
Q9What if no patch? (Workaround)
๐ง **Workaround**: If upgrading isn't possible, restrict network access to the Jellyfin server. ๐ Block outbound HTTP requests from the server to internal/private IP ranges.โฆ
โ ๏ธ **Priority**: Medium-High. ๐ **CVSS**: 5.3 (Medium). ๐ **Urgency**: Fix ASAP if exposed to the internet. ๐ก๏ธ **Reason**: Unauthenticated SSRF is a critical risk for internal network reconnaissance and data leakage.โฆ