Title: Serviio PRO 1.8 DLNA Media Streaming Server REST API Information Disclosure
Advisory ID: ZSL-2017-5404
Type: Local/Remote
Impact: Exposure of System Information, Exposure of Sensitive Information
Risk: (4/5)
Release Date: 03.05.2017

Summary

Serviio is a free media server. It allows you to stream your media files (music, video or images) to renderer devices (e.g. a TV set, Bluray player, games console or mobile phone) on your connected home network.

Description

The version of Serviio installed on the remote Windows/Linux host is affected by an information disclosure vulnerability due to improper access control enforcement of the Configuration REST API. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to gain access to potentially sensitive information.

Vendor

Petr Nejedly | Six Lines Ltd - http://www.serviio.org

Affected Version

1.8.0.0 PRO
1.7.1
1.7.0
1.6.1

Tested On

Restlet-Framework/2.2
Windows 7, UPnP/1.0 DLNADOC/1.50, Serviio/1.8
Mac OS X, UPnP/1.0 DLNADOC/1.50, Serviio/1.8
Linux, UPnP/1.0 DLNADOC/1.50, Serviio/1.8

Vendor Status

[12.12.2016] Vulnerability discovered.
[02.05.2017] Vendor communicated via Beyond Security's SecuriTeam Secure Disclosure program.

PoC

serviio_id.py

Credits

Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>

References

[1] https://blogs.securiteam.com/index.php/archives/3094
[2] https://www.exploit-db.com/exploits/41958/
[3] https://cxsecurity.com/issue/WLB-2017050022
[4] https://packetstormsecurity.com/files/142383
[5] http://www.securitylab.ru/poc/486048.php
[6] https://exchange.xforce.ibmcloud.com/vulnerabilities/125646

Changelog

[03.05.2017] - Initial release
[05.05.2017] - Added reference [2], [3] and [4]
[08.05.2017] - Added reference [5]
[30.05.2017] - Added reference [6]

Contact

Zero Science Lab

Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk