CVE-2020-26948

Description

Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.

Exploits & PoCs

• nucleiJellyfin Security Checksby dwisiswant0
• nucleiEmby < 4.5.0 - Server Server-Side Request Forgeryby dwisiswant0

References

• MISChttps://github.com/btnz-k/emby_ssrf
• MISChttps://github.com/btnz-k/emby_ssrf/blob/master/emby_scan.rb