Path Traversal in Mopidy Media Server

Executive Summary

This is a path traversal vulnerability in Mopidy versions before 4.0.5. The FileLibraryProvider.lookup() function lacks a containment check, allowing unauthenticated clients to access local files outside the configured media directories using file:// URIs via JSON-RPC or WebSocket calls. Attackers can probe file existence, read metadata, and play out-of-sandbox files.

Useful 0 Not Useful 0

Detection Guidance

Check Mopidy version with 'mopidy --version'. If it is below 4.0.5, the system is vulnerable. Monitor JSON-RPC/WebSocket requests for file:// URIs targeting core.library.lookup or core.tracklist.add. Review logs for suspicious file access attempts outside configured media directories.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to read metadata of files outside the media directories, probe file existence, or play unauthorized files. This may lead to information disclosure or unauthorized file access, depending on system permissions and file contents.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by enabling unauthorized access to local files outside designated directories. Attackers may probe file existence and read metadata, which could expose sensitive personal or health data if such files are present on the system. The lack of containment checks in file lookups increases the risk of data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Mopidy to version 4.0.5 or later immediately. Restrict network access to Mopidy's JSON-RPC/WebSocket interfaces. Review and tighten media_dirs configuration to minimize exposure. Monitor for unusual file access patterns.

Useful 0 Not Useful 0