CVE-2021-29490

published 2021-05-06

CVE-2021-29490: Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to 10.7.3 vulnerable…

Priority P2 64 medium 5.8 CVSS 3.1

AV N AC L PR N UI N S C C L I N A N

EXPLOIT

Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to 10.7.3 vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter. This issue potentially exposes both internal and external HTTP servers or other resources available via HTTP `GET` that are visible from the Jellyfin server. The vulnerability is patched in version 10.7.3. As a workaround, disable external access to the API endpoints `/Items/*/RemoteImages/Download`, `/Items/RemoteSearch/Image` and `/Images/Remote` via reverse proxy, or limit to known-friendly IPs.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
jellyfin	jellyfin	< 10.7.3	10.7.3
jellyfin	jellyfin	<= 10.7.2	—

Detection & IOCs extracted from sources · hover to see the quote

url /Images/Remote?imageUrl=https://oast.me/

url /Items/RemoteSearch/Image?ImageUrl=https://oast.me/&ProviderName=TheMovieDB

path /Images/Remote↗

path /Items/RemoteSearch/Image↗

path /Items/*/RemoteImages/Download↗

• → Detect SSRF probe requests targeting the /Images/Remote endpoint with an external imageUrl parameter via unauthenticated HTTP GET
• → Detect SSRF probe requests targeting the /Items/RemoteSearch/Image endpoint with an external ImageUrl parameter and ProviderName via unauthenticated HTTP GET
• → Confirm exploitation by matching the string ' Interactsh Server ' in the HTTP response body, indicating an out-of-band SSRF callback was triggered
• → Use Shodan query http.title:"Jellyfin" or FOFA query body="jellyfin" to identify exposed Jellyfin instances for targeted scanning
• → The vulnerability is exploitable without authentication (PR:N, UI:N); any unauthenticated GET request to the affected endpoints with a controlled imageUrl should be treated as suspicious ↗

• · The Nuclei template uses stop-at-first-match, meaning only one of the two probe paths will be tested per scan run; ensure both endpoints are covered in detection logic independently
• · SSRF scope is limited to HTTP GET requests; other protocols or POST-based SSRF are not indicated by this CVE ↗
• · The CVSS scope is Changed (S:C) with no integrity or availability impact (I:N, A:N), meaning exploitation is limited to information disclosure of HTTP-reachable resources from the server's network perspective

CVSS provenance

nvd v3.1 5.8 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-918