Listen to this Post
The vulnerability exploits a weak password recovery mechanism. Emby Server’s Forgot Password function generates a `passwordreset.txt` file containing a reset PIN in the server’s config folder. This file is intended for temporary use but lacks proper access controls. An unauthenticated attacker can directly request this file via the web server (e.g., `http://server:8096/web/configurationpage?name=passwordreset.txt`). By retrieving the PIN, the attacker can then call the password reset API endpoint, supplying the PIN to set a new password for any user, including administrators, thereby gaining full control of the Emby Server administration panel.
Platform: Emby Server
Version: All (pre-patch)
Vulnerability : Authentication Bypass
Severity: Critical
date: 2024-02-24
Prediction: Patched 2024-02-24
What Undercode Say:
Locate the vulnerable file find / -name "passwordreset.txt" 2>/dev/null Check if file is web-accessible (replace IP:PORT) curl -v http://192.168.1.100:8096/web/configurationpage?name=passwordreset.txt Remediation command from sudo chmod 444 /var/lib/emby/config/passwordreset.txt
How Exploit:
1. Attacker discovers Emby Server port (8096).
2. Requests `passwordreset.txt` via unauthenticated web path.
3. Extracts reset PIN from file contents.
4. Submits PIN to `/emby/Users/ForgotPassword/Pin` API.
5. Sets new admin password, gaining control.
Protection from this CVE:
Update Emby Server immediately.
Apply plugin auto-updates.
Restrict filesystem permissions.
Use network segmentation.
Impact:
Unauthorized full admin access.
Complete server compromise.
Data exposure, media manipulation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
