I don't know who needs to hear this, but DO NOT EVER expose Jellyfin to the internet

github.com Collection of potential security issues in Jellyfin · Issue #5415 · jellyfin/jellyfin

Collection of potential security issues in Jellyfin This is a non exhaustive list of potential security issues found in Jellyfin. Some of these might cause controversy. Some of these are design fla...

You're viewing a single thread.

156 comments

It's a list from 2021 and as a cybersec researcher and Jellyfin user I didn't see anything that would make me say "do not expose Jellyfin to the Internet".
That's not to say there might be something not listed, or some exploit chain using parts of this list, but at least it's not something that has been abused over the last four years if so.
- Agreed, this is a valid list of minor concerns but this is just a fearmongering post. It’s not good that some metadata can leak but if you take normal precautions (i.e. don’t run this next to your classified information storage) it’s fine to open this so your friends can watch media.
  Source: me and my Masters degree in cybersecurity (but apparently OP just learned about Kerckhoff’s principle and rainbow tables in a completely incorrect context so I know how to do my job or smth lmao)
  Edit: lol don’t look at OPs post history, now I know where the fearmongering came from
  
  It's nice to read something sane in these threads.
  
  Source: R1 masters professor. Literally the person you would have needed to take the class from on the topic at my institution.
  This is a problem simply because most paths and names will be similar due to *arr suites and docker mounts normalizing them to a standard that jellyfin wants to see. In the context of Sony's top 1000 movies, they can pre-compile the top 100 likely paths for the file (/movies, /mnt/movies, etc) then run the 100000 hash check through scripts against your instance. How long does it take to let a crawler collect http statuses on 100000 page loads? Now put that to a bot that gets jellyfin instances from a tool like shodan and add more hashes. If you flag, now onus is on you to prove you have license for content and they would have a case that you distributing (albeit weak) since your server was open to the public. This is child's play level abuse-able. Risking that something easy like this isn't being abused by Sony and others (you know... willing to install a rootkit on your computer types...) is a very silly stance to take.
  The hash that's used to represent the path isn't salted or otherwise unique.
  Edit: mobile typos.
  
  If I have rate limiting set up (through crowdsec) to prevent bots from scanning / crawling my server, should I be as worried?
  
  Probably not. But depending on how it's configured it could still be a gamble/risk. A rate limiting setup can mitigate it a lot.
  
  but if you take normal precautions (i.e. don’t run this next to your classified information storage)
  oh yeah I'm pretty sure the majority of users bought a dedicated machine for Jellyfin
  
  More likely than other services due to HWA.
  
  my impression was that people either just put a graphics card in their server, or run jellyfin from the desktop/laptop
- The last set of comments is from 2024. These have not been addressed. The fact that it is possible to stream without auth is just bonkers.
  The entirity of jellyfin security is security via obscurity which is zero security at all.
  "As a cybersec researcher", the limp wristed, hand wavy approach to security should be sending up alarm bells. The fact that it doesn't, means that likely either, you don't take your research very seriously, or you aren't a "cybersecurity researcher".
  "Thank you for this list. We are aware of quite a few, but for reasons of backwards compatibility they've never been fixed. We'd definitely like to but doing so in a non-disruptive way is the hard part."
  Is truly one of the statements of all time.
  
  How is someone meant to guess what seems to be a randomly generated id? If they try to brute force it then you could probably set up something like fail2ban to block them after a few failed attempts.
  I’m not saying video ids shouldn’t require authentication, they should but the risk of someone getting the video id seems fairly low.
  
  It isn't randomly generated. If you read through you would have known that.
  Also, Rainbow tables.
  tldr, Rainbow tables are precomputed lists of hashed values used to crack password hashes quickly. Instead of hashing each password guess on the fly, attackers use these tables to reverse hashes and find the original passwords faster, especially for weak or common ones. They're less effective against hashes protected by a unique salt.
  
  If the ID is the MD5 of the path, rainbow tables are completely useless. You don't have the hash. You need to derive the hash by guessing the path to an existing file, for each file.
  
  How unique do you suppose file system paths are?
  How many hashes would one need to gather to quickly determine the root path for all files? Paths are not random so guessing the path is just a rainbow table.
  The scanning for known releases becomes trivial once the file system pattern is known.
  
  I've not looked but if the video id is based on its path, then surely the path includes the filename no? You can't split a hash into its separate original parts, you either guess the entire thing or not. So in that case, the hash is going to challenging to brute force.
  
  It's not that challenging if you are looking for specific media files, but if you wanted to enumerate the files on a server it's basically impossible.
  
  but if you wanted to enumerate the files on a server it’s basically impossible.
  Well lets say your a big movie studio... In the past 10 years you've released 40-50 movies. You pay some lawfirm to go out and find illegal copies of your movies.
  Those 40-50 movies * 1000 or 10000 common paths/names makes you a nice table of likely candidates. Prehash that table in MD5. It doesn't take all that much effort to "enumerate" all the movies that your studio cares about. 50000 http requests is childs play and you can scan a public server within minutes for your list.
  Fully bruteforcing the thing... yeah that's ridiculous. But I don't think that people are naming bigbucksbunny.mkv as Rp23GXTHp4GN7P6j86HjRdxtfSKKAArj.mkv. So it's not like we're looking for "random" or "all" files anyway.
  I don't think anyone was ever saying that the risk here is full enumeration. Though it is technically possible with sufficient time... just will take a lot of time.
  
  That is possible, but I don't think you need to worry about that. Having a copy of a movie is not normally itself a crime.
  
  Having it publicly accessible on a web server is distribution. And that normally IS a crime unless you have some licenses to do so.
  
  If the server is using a standard path prefix and a standard file layout and is using standard file names it isn't that difficult to find the location of a media file and then from there it would be easier to find bore files, assuming the paths are consistent.
  But even for low entropy strings, long strings are difficult to brute force, and rainbow tables are useless for this use case.
  
  You can't say that a solution is no security at all when it requires time and intelligence to bypass.
  It is at least 0.01 security.
  
  Effort or no, if an attacker can reasonably bypass it, it's not secure. That's why software gets security patches all the time, why encryption/hashing algorithms can fall out of favor, and why quantum computing can be pretty fucking scary.
  
  No system is secure.
  
  #confidentlyincorrect
  
  The votes are not on your side
  
  I didn't say it's secure, I just said it's security.
- Fully agreed. There's some stuff in the list that could leak server info or metadata about available content to the public, but the rest seems to require some knowledge before being able to exploit it, such as user IDs.
  That doesn't mean these aren't issues, but they're not "take your jellyfin down now" type issues either.
- So I have a NAS running Ubuntu I only keep my movies, my Jellyfin, and torrent software on in an isolated VLAN I stream from. I would think this would make any security issue with Jellyfin a dead end. I stream all content from Jellyfin domain I made and never use it locally. I stream off it at home from my VPN. This seems a safe way to stream where it can be used away from home unless I am missing something? Pointing out any holes in my logic is appreciated.
- Yea many of the linked issues are already closed. Why is this post not down-voted like crazy?
  
  No. None of the items are closed. Click the "closed" items. All of them are "Not planned. Duplicate, see 5415".
  
  The same reason FUD is so popular in regular news.

156 comments