CVE-2023-49096
📋 TL;DR
Jellyfin media server has an argument injection vulnerability in video/audio streaming endpoints that allows unauthenticated attackers to inject malicious arguments into FFmpeg commands. This could lead to arbitrary file overwrites or remote code execution. All Jellyfin instances running vulnerable versions are affected.
💻 Affected Systems
- Jellyfin
📦 What is this software?
Jellyfin by Jellyfin
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment
Likely Case
Arbitrary file overwrite allowing privilege escalation, configuration modification, or denial of service
If Mitigated
Limited impact due to requirement to guess random GUID itemId and lack of information leak
🎯 Exploit Status
Exploitation requires guessing random GUID itemId, making direct exploitation difficult without additional information leak
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.8.13
Vendor Advisory: https://github.com/jellyfin/jellyfin/commit/a656799dc879d16d21bf2ce7ad412ebd5d45394a
Restart Required: Yes
Instructions:
1. Backup your Jellyfin configuration and database. 2. Stop Jellyfin service. 3. Update to version 10.8.13 via package manager or manual installation. 4. Restart Jellyfin service. 5. Verify version is 10.8.13 or higher.
🔧 Temporary Workarounds
No known workarounds
allThe vendor states there are no known workarounds for this vulnerability
🧯 If You Can't Patch
- Restrict network access to Jellyfin instance using firewall rules
- Implement reverse proxy with request validation and rate limiting
🔍 How to Verify
Check if Vulnerable:
Check Jellyfin version via web interface Dashboard or systemctl status jellyfinCheck Version:
systemctl status jellyfin | grep version or check web interface DashboardVerify Fix Applied:
Confirm version is 10.8.13 or higher and test streaming functionality📡 Detection & Monitoring
Log Indicators:
- Unusual FFmpeg command arguments
- Failed authentication attempts with GUID patterns
- Multiple requests to /Videos/*/stream endpoints
Network Indicators:
- Unusual parameter values in streaming requests
- Multiple failed streaming requests from single IP
SIEM Query:
source="jellyfin.log" AND ("videoCodec" OR "audioCodec") AND ("|" OR ";" OR "$" OR "&")🔗 References
- https://cwe.mitre.org/data/definitions/88.html
- https://en.wikipedia.org/wiki/Pass_the_hash
- https://ffmpeg.org/ffmpeg-filters.html#drawtext-1
- https://github.com/jellyfin/jellyfin/commit/a656799dc879d16d21bf2ce7ad412ebd5d45394a
- https://github.com/jellyfin/jellyfin/issues/5415
- https://github.com/jellyfin/jellyfin/security/advisories/GHSA-866x-wj5j-2vf4
- https://cwe.mitre.org/data/definitions/88.html
- https://en.wikipedia.org/wiki/Pass_the_hash
- https://ffmpeg.org/ffmpeg-filters.html#drawtext-1
- https://github.com/jellyfin/jellyfin/commit/a656799dc879d16d21bf2ce7ad412ebd5d45394a
- https://github.com/jellyfin/jellyfin/issues/5415
- https://github.com/jellyfin/jellyfin/security/advisories/GHSA-866x-wj5j-2vf4
