Emby Exploit - 2023-05-25

[AGTDenton]

I've recently learned of an Emby exploit for local servers that are configured to be accessible via the Internet.
Please check out the link for fixes until a patch is released!

Starting Mid-May 2023, a hacker managed to infiltrate private user-hosted instances of Emby Server which were accessible via public internet and had an insecure configuration for administrative user accounts. Combined with the "Proxy Header Vulnerability", which was recently fixed in the beta channel, this allowed an attacker to gain administrative access on such systems. Eventually, this allowed the attackers to install a custom plugin of their own, which establishes a backdoor in the running process of Emby Server.

Source: https://emby.media/support/articles/advisory-23-05.html