Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2017-20217 is an information disclosure vulnerability in Serviio PRO version 1.8 and earlier. It occurs due to improper access control enforcement in the Configuration REST API, which allows unauthenticated remote attackers to send specially crafted HTTP requests to certain REST API endpoints and retrieve sensitive configuration data without any authentication.'}, {'type': 'list_item', 'content': 'The vulnerability affects multiple platforms including Windows, Linux, and Mac OS X.'}, {'type': 'list_item', 'content': 'Attackers can access sensitive information such as media streaming URLs, directory listings of system paths (e.g., /etc on Linux), and the MediaBrowser remote access password in plaintext.'}, {'type': 'list_item', 'content': "The exploit involves sending HTTP GET requests with the header 'Accept: application/xml' to REST API endpoints like /rest/import-export/online, /rest/list-folders, and /rest/remote-access."}, {'type': 'paragraph', 'content': 'This vulnerability arises because the REST API fails to enforce proper authentication and access controls on critical functions.'}] [1, 3, 4, 5]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have significant impacts by exposing sensitive information to unauthorized remote attackers without requiring any authentication.

• Attackers can obtain media streaming URLs, which could allow them to access or monitor media content streams.
• They can retrieve directory listings of sensitive system paths, potentially revealing system structure and files that could be used for further attacks.
• The MediaBrowser remote access password can be disclosed in plaintext, enabling attackers to gain unauthorized remote access to the media server.

Overall, this leads to a breach of confidentiality and could facilitate further exploitation or unauthorized access to the affected system.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by sending specially crafted HTTP GET requests to the Serviio PRO Configuration REST API endpoints without authentication and checking for sensitive information in the responses.'}, {'type': 'list_item', 'content': "Send HTTP GET requests with the header 'Accept: application/xml' to the following endpoints:"}, {'type': 'list_item', 'content': '1. /rest/import-export/online — to retrieve Serviio media links (e.g., video feed URLs).'}, {'type': 'list_item', 'content': '2. /rest/list-folders?directory=/etc (or other directories) — to list directory contents on the server.'}, {'type': 'list_item', 'content': '3. /rest/remote-access — to obtain the MediaBrowser remote access password in plaintext.'}, {'type': 'paragraph', 'content': 'For example, using curl commands to test the endpoints:'}, {'type': 'list_item', 'content': 'curl -H "Accept: application/xml" http://<target-ip>:<port>/rest/import-export/online'}, {'type': 'list_item', 'content': 'curl -H "Accept: application/xml" http://<target-ip>:<port>/rest/list-folders?directory=/etc'}, {'type': 'list_item', 'content': 'curl -H "Accept: application/xml" http://<target-ip>:<port>/rest/remote-access'}, {'type': 'paragraph', 'content': 'If these requests return XML data containing media links, directory listings, or plaintext passwords without authentication, the vulnerability is present.'}] [1, 4]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the Serviio PRO Configuration REST API to trusted users and networks only.

Specifically:

• 1. Limit network access to the REST API endpoints by firewall rules or network segmentation to prevent unauthenticated external access.
• 2. Disable or restrict the Configuration REST API if it is not required.
• 3. Apply any available patches or updates from the vendor that address this vulnerability.

Since the vulnerability arises from improper access control enforcement, ensuring proper authentication and authorization on the REST API is critical.

Useful 0 Not Useful 0