Jellyfin up to 10.8.12 /Videos//stream argument injection

Summaryinfo

A vulnerability was found in Jellyfin up to 10.8.12. It has been classified as critical. This impacts an unknown function of the file /Videos//stream. The manipulation leads to argument injection. This vulnerability is documented as CVE-2023-49096. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Jellyfin up to 10.8.12 and classified as critical. This issue affects an unknown code block of the file /Videos//stream. The manipulation with an unknown input leads to a argument injection vulnerability. Using CWE to declare the problem leads to CWE-88. The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Jellyfin is a Free Software Media System for managing and streaming media. In affected versions there is an argument injection in the VideosController, specifically the `/Videos//stream` and `/Videos//stream.` endpoints which are present in the current Jellyfin version. Additional endpoints in the AudioController might also be vulnerable, as they differ only slightly in execution. Those endpoints are reachable by an unauthenticated user. In order to exploit this vulnerability an unauthenticated attacker has to guess an itemId, which is a completely random GUID. It’s a very unlikely case even for a large media database with lots of items. Without an additional information leak, this vulnerability shouldn’t be directly exploitable, even if the instance is reachable from the Internet. There are a lot of query parameters that get accepted by the method. At least two of those, videoCodec and audioCodec are vulnerable to the argument injection. The values can be traced through a lot of code and might be changed in the process. However, the fallback is to always use them as-is, which means we can inject our own arguments. Those arguments land in the command line of FFmpeg. Because UseShellExecute is always set to false, we can’t simply terminate the FFmpeg command and execute our own. It should only be possible to add additional arguments to FFmpeg, which is powerful enough as it stands. There is probably a way of overwriting an arbitrary file with malicious content. This vulnerability has been addressed in version 10.8.13. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The weakness was released 12/06/2023. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2023-49096 since 11/21/2023. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059 according to MITRE ATT&CK.

Upgrading to version 10.8.13 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Jellyfin

Version

• 10.8.0
• 10.8.1
• 10.8.2
• 10.8.3
• 10.8.4
• 10.8.5
• 10.8.6
• 10.8.7
• 10.8.8
• 10.8.9
• 10.8.10
• 10.8.11
• 10.8.12

License

• open-source

Website

• Product: https://github.com/jellyfin/jellyfin/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion