CVE-2023-30626: 
C# vulnerability analysis and mitigation

CVE-2023-30626 is a directory traversal vulnerability discovered in Jellyfin, a free-software media system. The vulnerability affects versions starting with 10.8.0 and prior to 10.8.10, specifically in the ClientLogController component at the /ClientLog/Document endpoint. When combined with a cross-site scripting vulnerability (CVE-2023-30627), this vulnerability could lead to file write capabilities and arbitrary code execution (GitHub Advisory).

The vulnerability exists in the ClientLogController where the GetRequestInformation method retrieves client name and version from the HttpContext.User object. These attacker-controlled values are interpolated into a string used in Path.Combine(), enabling directory traversal. The vulnerability has a CVSS v3.1 Base Score of 8.1 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N according to NVD assessment (NVD).

When exploited, an attacker can write files with controlled content to arbitrary locations on the filesystem. While the resulting files always end with '.log' extension, this can still be leveraged for malicious purposes. On Linux systems running as root in a container, the impact could be more severe as it allows writing to any location. When combined with CVE-2023-30627, this vulnerability enables remote code execution with the privileges of the user running Jellyfin (GitHub Advisory).

The vulnerability has been patched in Jellyfin version 10.8.10. The fix includes adding path traversal checks in the WriteDocumentAsync method. There are no known workarounds, and it is critical for all Jellyfin administrators to upgrade to version 10.8.10, especially if they allow untrusted users or expose their instance to the Internet (Jellyfin Release).

The release of version 10.8.10 received significant attention from the community, with over 80 users reacting to the release announcement on GitHub. The security fix was marked as a CRITICAL SECURITY ADVISORY in the release notes, emphasizing the severity of the vulnerability (Jellyfin Release).