CVE-2023-33193: Emby Server Proxy Header Spoofing Vulnerability
Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewing at home and abroad on a broad range of client devices. This vulnerability may allow administrative access to an Emby Server system, depending on certain user account settings. By spoofing certain headers which are intended for interoperation with reverse proxy servers, it may be possible to affect the local/non-local network determination to allow logging in without password or to view a list of user accounts which may have no password configured. Impacted are all Emby Server system which are publicly accessible and where the administrator hasn't tightened the account login configuration for administrative users. This issue has been patched in Emby Server Beta version 4.8.31 and Emby Server version 4.7.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Emby Serverto a version that resolves this vulnerability.Fixed in 4.8.31 - Upgrade
Upgrade
Emby Serverto a version that resolves this vulnerability.Fixed in 4.7.12 - Configuration
For publicly accessible Emby Server instances, tighten the account login configuration for administrative users (the material states the issue impacts admins where this has not been tightened).
Emby Server (administrator login configuration) account login configuration for administrative users = tighten - Compensating control
Ensure the Emby Server instance is not publicly accessible unless administrative login configuration is tightened, since public exposure is explicitly called out as being impacted.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-33193?
CVE-2023-33193 is classified as a critical vulnerability due to the potential for unauthorized administrative access to Emby Server.
How do I fix CVE-2023-33193?
To mitigate CVE-2023-33193, users should upgrade their Emby Server to version 4.8.31 or later.
What versions of Emby Server are affected by CVE-2023-33193?
CVE-2023-33193 affects Emby Server versions prior to 4.7.0.12 and between 4.8.0.0 and 4.8.31.
What kind of access does CVE-2023-33193 allow?
CVE-2023-33193 allows attackers to gain unauthorized administrative access to Emby Server.
Is there a workaround for CVE-2023-33193?
Currently, the recommended action is to update to the latest version of Emby Server as there are no known workarounds.