Emby Server allows attackers to gain administrative server access without preconditions

Vulnerability

The vulnerability in Emby Server versions prior to 4.9.1.81 permits an unauthenticated attacker to gain full administrative access to the Emby Server's web interface. The root cause lies in an API endpoint that fails to properly enforce authentication or authorization checks, enabling privilege escalation without any prerequisites beyond network connectivity [1][2].

Exploitation

Exploitation requires only network access to the server; no prior authentication or user interaction is needed. The attack likely involves the password reset functionality, as indicated by the workaround of restricting access to the passwordreset.txt file [2]. An attacker can directly call the vulnerable API to obtain administrative privileges.

Impact

Successful exploitation grants the attacker complete control over the Emby Server administration, allowing actions such as modifying server settings, managing users, and accessing media libraries. The vulnerability does not extend to the underlying operating system, limiting direct OS compromise [1].

Mitigation

The vulnerability is fixed in Emby Server version 4.9.1.81. A temporary workaround involving restrictive file permissions on passwordreset.txt is now obsolete as the patch supersedes this mitigation. Users are strongly advised to update their servers immediately [2][3].