CVE-2021-29490: 
NixOS vulnerability analysis and mitigation

Jellyfin, a free software media system that provides media from a dedicated server to end-user devices, was found to contain a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 10.7.3. The vulnerability was identified and tracked as CVE-2021-29490, affecting the imageUrl parameter across multiple API endpoints. The issue was discovered and disclosed in May 2021, impacting all Jellyfin installations before version 10.7.3 (GitHub Advisory, NVD).

The vulnerability exists in three API endpoints: '/Images/Remote', '/Items/RemoteSearch/Image', and '/Items/{itemId}/RemoteImages/Download'. These endpoints were susceptible to unauthenticated SSRF attacks through the imageUrl parameter. The vulnerability received a CVSS v3.1 base score of 5.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N, indicating network attack vector, low attack complexity, no privileges required, and no user interaction needed (NVD).

The vulnerability could expose both internal and external HTTP servers or other resources accessible via HTTP GET that are visible from the Jellyfin server. This allows for information disclosure and exfiltration, unauthenticated access to internal network HTTP servers, and enables port and IP scanning and enumeration of the local network. Attackers could potentially access any HTTP server connected to the same network as the Jellyfin server, including internal services like Nginx servers, RESTful APIs, or databases (GitHub Advisory).

The vulnerability requires no authentication or special privileges to exploit, making it highly accessible to potential attackers. The attack can be executed remotely through the affected API endpoints by sending specially crafted HTTP GET requests (GitHub Advisory).

The vulnerability was patched in Jellyfin version 10.7.3. For users unable to update immediately, a workaround is available by disabling external access to the API endpoints '/Items/*/RemoteImages/Download', '/Items/RemoteSearch/Image' and '/Images/Remote' via reverse proxy, or limiting access to known-friendly IPs (GitHub Advisory).