← Advisories

Serviio PRO 1.8 DLNA Media Streaming Server REST API Information Disclosure

High
Advisory ID
ZSL-2017-5404
Release Date
03 May 2017
Vendor
Petr Nejedly, Six Lines Ltd - http://www.serviio.org
Affected Version
1.8.0.0 PRO, 1.7.1, 1.7.0, 1.6.1
Tested On
Restlet-Framework/2.2, Windows 7, UPnP/1.0 DLNADOC/1.50, Serviio/1.8, Mac OS X, UPnP/1.0 DLNADOC/1.50, Serviio/1.8, Linux, UPnP/1.0 DLNADOC/1.50, Serviio/1.8
Summary

Serviio is a free media server. It allows you to stream your media files (music, video or images) to renderer devices (e.g. a TV set, Bluray player, games console or mobile phone) on your connected home network.

Description

The version of Serviio installed on the remote Windows/Linux host is affected by an information disclosure vulnerability due to improper access control enforcement of the Configuration REST API. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to gain access to potentially sensitive information.

Proof of Concept
Disclosure Timeline
12.12.2016Vulnerability discovered.
02.05.2017Vendor communicated via Beyond Security's SecuriTeam Secure Disclosure program.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
03.05.2017Initial release
05.05.2017Added reference [2], [3] and [4]
08.05.2017Added reference [5]
30.05.2017Added reference [6]
24.03.2026Added reference [7]