CVE-2021-21402 PoC — Unauthenticated Arbitrary File Access in Jellyfin

Source

https://github.com/somatrasss/CVE-2021-21402

Associated Vulnerability

Title: Unauthenticated Arbitrary File Access in Jellyfin (CVE-2021-21402)
Description:Jellyfin is a Free Software Media System. In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from a Jellyfin server's file system. This issue is more prevalent when Windows is used as the host OS. Servers that are exposed to the public Internet are potentially at risk. This is fixed in version 10.7.1. As a workaround, users may be able to restrict some access by enforcing strict security permissions on their filesystem, however, it is recommended to update as soon as possible.

Description

本项目涉及到的仅为安全研究和授权情况下使用，其使用人员有责任和义务遵守当地法律条规。

Readme

#CVE-2021-21402 Jellyfin任意文件读取 

漏洞简介

jellyfin是一个自由的软件媒体系统，用于控制和管理媒体和流媒体。它是emby和plex的替代品，它通过多个应用程序从专用服务器向终端用户设备提供媒体。Jellyfin属于Emby 3.5.2 .NET核心框架，以支持完全的跨平台支持。
Jellyfin10.7.1版本中，攻击者恶意构造请求将允许从Jellyfin服务器的文件系统中读取任意文件。当Windows使用主机OS时，此问题更加普遍。暴露于公共Internet的服务器可能会受到威胁。在版本10.7.1中已修复此问题。解决方法是，用户可以通过在文件系统上实施严格的安全权限来限制某些访问。

影响版本：

果冻<10.7.1

解决方案

1.升级 Jellyfin 至安全版本（10.7.1）：
https://jellyfin.org/downloads/

2.用户通过在文件系统上实施严格的安全权限来限制某些访问。

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →