Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in Jellyfin media server allows an unauthenticated attacker to read arbitrary files from the server. The issue stems from improper handling of query parameters, which can be manipulated to inject commands into the underlying ffmpeg process. This could lead to the exposure of sensitive system information.
- Sensitive files can be read.
- Exploitable over the internet.
- No login needed.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this vulnerability by sending a crafted request to the Jellyfin media server's streaming endpoint. By manipulating the `StreamOptions` query parameter with a special `ffmpeg` command, the attacker can force the server to read arbitrary files and exfiltrate their content through the video stream. This allows for the disclosure of sensitive server-side information.
- Unauthenticated network access required.
- Exploits ffmpeg argument injection.
- Requires knowledge of item GUIDs.
Live Threat
Current exploitation, exposure, and threat context
Attackers may find this vulnerability appealing due to its unauthenticated and critical nature, allowing for arbitrary file reads. While the vulnerability itself is severe, obtaining the necessary item GUIDs to target specific streams requires prior authenticated access, which could temper its immediate widespread weaponization. However, this could change if methods to enumerate or guess GUIDs emerge.
- Unauthenticated arbitrary file read.
- Requires item GUIDs for targeting.
- Fixed in version 10.11.7.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize immediate patching of Jellyfin to version 10.11.7 to address the unauthenticated arbitrary file read vulnerability. If patching is not immediately feasible, focus on network-level filtering and strict access controls to prevent exploitation of the streaming endpoint.
- Apply Jellyfin version 10.11.7 or later.
- Block network traffic to the streaming endpoint.
- Monitor logs for suspicious requests to /Videos/{itemId}/stream.
