Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in Jellystat allows an authenticated user to inject malicious SQL code into the application. This could lead to unauthorized access to sensitive data and potentially allow for remote code execution on the server hosting the database.
- Data theft risk: Can read all database tables.
- Credential compromise: Exposes admin credentials and API keys.
- Remote code execution: Enables attackers to run commands on the server.
Attack Path
How an attacker could exploit the issue
An authenticated user with access to the Jellystat API could exploit this vulnerability. By sending specially crafted SQL queries through `POST /api/getUserDetails` or `POST /api/getLibrary`, an attacker can achieve read access to all database tables. This includes sensitive configuration data like admin credentials and API keys, and can be escalated to arbitrary command execution on the PostgreSQL host.
- Requires authenticated user access.
- Targets API endpoints.
- PostgreSQL superuser role is default.
Live Threat
Current exploitation, exposure, and threat context
Attackers are unlikely to weaponize this vulnerability for widespread exploitation. The target software, Jellystat, is a self-hosted statistics app for Jellyfin, typically deployed within private networks, and not directly exposed to the public internet. Exploitation would require authenticated access and specific deployment scenarios, making it less attractive for broad attacks compared to vulnerabilities in internet-facing services.
- Requires authenticated user.
- Target is not internet-facing.
- No known exploit in the wild.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Given the CRITICAL severity and potential for remote code execution, prioritize patching Jellystat to version 1.1.10 or higher immediately. If patching is not feasible, isolate affected Jellystat instances from external networks and internal sensitive systems.
- Update Jellystat to version 1.1.10.
- Restrict network access to Jellystat.
- Monitor logs for unusual database activity.
