I don't know who needs to hear this, but DO NOT EVER expose Jellyfin to the internet

Submitted ⁨⁨3⁩ ⁨weeks⁩ ago⁩ by ⁨Scary_le_Poo@beehaw.org⁩ to ⁨technology@beehaw.org⁩

https://github.com/jellyfin/jellyfin/issues/5415

Collection of potential security issues in Jellyfin This is a non exhaustive list of potential security issues found in Jellyfin. Some of these might cause controversy. Some of these are design fla…

source

Comments

Sort:hotnew top

kratoz29@lemm.ee ⁨3⁩ ⁨weeks⁩ ago
Huh, I can’t check the link right now… But if exposing Jellyfin to the Internet is not an option, then it is not ready to be shipped as the Plex replacement I have heard a lot here and on Reddit.

source
- fmstrat@lemmy.nowsci.com ⁨2⁩ ⁨weeks⁩ ago
  The linked post is from 2021. Many of the items were already closed. This looks like fear mongering.
  
  source
- t3rmit3@beehaw.org ⁨2⁩ ⁨weeks⁩ ago
  Put the instance behind another authentication point like a VPN or reverse proxy with SSO. That will prevent the wider Internet from accessing it without legitimate users being cut off. You should be doing this with any server you operate, but definitely one that may have legal implications.
  
  source
  - ReversalHatchery@beehaw.org ⁨2⁩ ⁨weeks⁩ ago
    aaaand now you smart tv can’t connect. none of them. the clients dont even support http basic auth creds put into the URL for some crazy reason.
    
    for advanced HTTP-level authentication you would need to run a reverse proxy on the TV’s network that would add the authentication info. for the VPN idea you would need to tunnel the TV’s network’s internet connection at the router. or set up a gateway address in the TVs network settings that would do that. or use a reverse proxy here too so that it repeats the request to the real server.
    
    but honestly, this is the real and only secure way anyway. I wouldn’t be comfortable to expose jellyfin even if the devs are real experts. I mean vulns get discovered, in dotnet, jellyfin dependencies, linux filesystem, and reverse proxy, and honestly who has time to always tightly keep up to date with all that.
    
    that’s not to discount the seriousness of the issue though, it’s a real shame that jellyfin is so much against security
    
    source
    -> View More Comments
  - kratoz29@lemm.ee ⁨2⁩ ⁨weeks⁩ ago
    I am sorry, I don’t think I follow, I am CGNATED anyway, so I need to use VPNs to access my server (if IPv6 is not available, for IPv4 I am experimenting with Tailscale funnels as of now).
    
    source
    -> View More Comments
- Chastity2323@midwest.social ⁨2⁩ ⁨weeks⁩ ago
  Do we even know that Plex is better? It’s closed source and hasn’t been audited afaik
  
  source
  - kratoz29@lemm.ee ⁨2⁩ ⁨weeks⁩ ago
    It is if you have compared them together.
    
    I haven’t recently thought and I am a lifetime Plex pass user (we will see what lifetime truly means sooner or later) and I have still been unaffected by most of the changes Plex has done (watch together is the 1st valuable feature that I have lost), so if you can’t expose Jellyfin then it is not better than Plex for me.
    
    source
- p03locke@lemmy.dbzer0.com ⁨2⁩ ⁨weeks⁩ ago
  Agreed. I’m a bit disappointed that it’s being touted as such. If you need a local LAN option, use VLC Player.
  
  source
anarchiddy@lemmy.dbzer0.com ⁨2⁩ ⁨weeks⁩ ago
I’m not sure who needs to hear this, but unless you work as a security engineer or in another security-focused tech field, you really shouldn’t be exposing your homelab to the open internet anyway

Most people access their homelabs via VPN - i don’t see anything here that’s a problem for that use-case.

source
- ocean@lemmy.selfhostcat.com ⁨2⁩ ⁨weeks⁩ ago
  Many people host websites ;)
  
  source
  - anarchiddy@lemmy.dbzer0.com ⁨2⁩ ⁨weeks⁩ ago
    And I would hope those websites are extremely low-risk and not anywhere near essential infrastructure or data ;)
    
    source
- jagged_circle@feddit.nl ⁨2⁩ ⁨weeks⁩ ago
  I need to run a VPN already. Fine for desktop, but this isn’t a solution for mobile (where you can’t run two VPNs simultaneously)
  
  source
easily3667@lemmus.org ⁨2⁩ ⁨weeks⁩ ago
For those unaware, it’s a good idea to be using a service like tailscale (self hosted=headscale if you don’t want to make your login credentials tied to apple, google, or Microsoft). It’s a VPN but a lot simpler to use.

source
- jagged_circle@feddit.nl ⁨2⁩ ⁨weeks⁩ ago
  I dont know what that means.
  
  Can I use that in addition to another VPN on mobile?
  
  source
  - easily3667@lemmus.org ⁨2⁩ ⁨weeks⁩ ago
    Afaik android doesn’t allow two VPNs at the same time. If you have a VPN back to your home already, like via your router, you don’t need tailscale although I’d argue it’s still better.
    
    If you mean a VPN like mullvad, afaik you can’t mullvad and tailscale at the same time. I may be wrong but I gave up on global VPNs a while ago.
    
    source
    -> View More Comments
ipkpjersi@lemmy.ml ⁨2⁩ ⁨weeks⁩ ago
Many of these have already been fixed FWIW, it’s not a collection of open issues.

source
ReversalHatchery@beehaw.org ⁨2⁩ ⁨weeks⁩ ago
I remember when they were arguing that you don’t need a VPN or proxy basic authentication in frontbof it because their team knows how to write secure code…

source
- jagged_circle@feddit.nl ⁨2⁩ ⁨weeks⁩ ago
  There’s a bug (closed as won’t fix) where proxy basic authentication breaks jellyfin. You can’t use it.
  
  source
HappyTimeHarry@lemm.ee ⁨2⁩ ⁨weeks⁩ ago
If my server is already open to everyone, what kind of potential attacks do i need to be worried a about? I dont keep personal files on my streaming server, its just videos, music and isos/roms. I dont restrict sign ups, so the idea of an unauthorized user doing something like download a video is a non issue for me really.

I do see where there could be problems for folks running jfin on the same server they keep private photos or for people who charge users for acess, but thats not me.

Am i missing something or is the main result of most of these that a “malicious” actor could dowload files jellyfin has access to without authentication?

source
- jagged_circle@feddit.nl ⁨2⁩ ⁨weeks⁩ ago
  I guess the worst thing is that your server starts attackijmg the US military servers because you’ve become part of a botnet.
  
  That happened to my friend one time when I installed Linux on his computer. He made the username and password the same word. Got a letter from the DoD.
  
  I dont think they would be so forgiving these days. Especially if you’re brown.
  
  source
tnsi@warhammer.social ⁨3⁩ ⁨weeks⁩ ago
@Scary_le_Poo I wouldn't say never, but in most cases, you're best served by sticking it behind wireguard- but this is also true of any service or tool you don't intend to make available to the greater internet
source
Powderhorn@beehaw.org ⁨3⁩ ⁨weeks⁩ ago
Who has the technical wherewithal to run Jellyfin but leaves access on the open web? I get that sharing is part of the point, but no one’s putting their media collection on an open FTP server.

The level of convenience people expect without consequences is astounding. Going to be away for home for a few days? Load stuff onto an external SSD or SD card. Phoning home remotely makes no sense.

source
- Kusimulkku@lemm.ee ⁨3⁩ ⁨weeks⁩ ago
  Friends, family using Jellyfin is the reason many have it directly available (and not behind VPN for example).
  
  source
- LandedGentry@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago
  [deleted]
  source
  - PolarisFx@lemmy.dbzer0.com ⁨3⁩ ⁨weeks⁩ ago
    They jacked their prices, or are about to anyway. If you don’t have a lifetime Plex pass then Plex might not be a viable option. My seedbox provider has been pushing people to Jellyfin for anyone without a Plex pass.
    
    source
    -> View More Comments
  - ReversalHatchery@beehaw.org ⁨2⁩ ⁨weeks⁩ ago
    that’s but no. I like my privacy more
    
    source
    -> View More Comments
  - Flax_vert@feddit.uk ⁨2⁩ ⁨weeks⁩ ago
    Doesn’t have a sync play feature like Jellyfin does
    
    source
    -> View More Comments
- Omgboom@lemmy.zip ⁨2⁩ ⁨weeks⁩ ago
  
  I get that sharing is part of the point, but no one’s putting their media collection on an open FTP server.
  
  You would be very wrong about that. You can even search open FTP servers on using Google
  
  palined.com/search/
  
  source
  - Powderhorn@beehaw.org ⁨2⁩ ⁨weeks⁩ ago
    OK. I’ll revise. No one with any sense is doing this. “Hi, RIAA and MPAA, come after me” is an asinine approach. I realize we have at least one generation unfamiliar with Napster, KaZaa and LimeWire, which replaced ratio FTP servers (which in turn replaced F-Servs in IRC. This is terrible online hygiene. You don’t leave your media out there for all to see. At least password protect access before linking to your friends.
    
    source
- jarfil@beehaw.org ⁨2⁩ ⁨weeks⁩ ago
  The typical guides for installing Jellyfin and friends, stop at the point where you can access the service, expecting you to secure it further.
  
  Turns out, the default configuration for many (most) routers, is to allow external access to anything a local service will request it to allow, expecting you to secure it further.
  
  Leaving it like that, is an explosive combo, which many users never intended to set up, but have nonetheless.
  
  source
- Waryle@jlai.lu ⁨2⁩ ⁨weeks⁩ ago
  My Jellyfin server is behind Cloudflare with IP outside of my country banned.
  
  I got Crowdsec set up on Cloudflare, Traefik and Debian directly.
  
  I got Jellyfin up in a docker container behind Traefik, my router opens only 80 and 443 ports and direct them to Traefik.
  
  Jellyfin has only access to my media files which are just downloaded movies and shows hardlinked by Sonarr/Radarr from my download folder.
  
  It is publicly exposed to be able to watch it from anywhere, and share it to family and friends.
  
  So what? They might access the movies, even delete them, I don’t care, I’ll just hardlink them back or re-download them. What harm can they do that would justify locking everything down?
  
  source
GiuseppeAndTheYeti@midwest.social ⁨2⁩ ⁨weeks⁩ ago
Can someone ELI5 this for me? I have a jellyfin docker stack set up through dockstarter and managed through portainer. I also own a domain that uses cloudflare to access my Jellyfin server. Since everything is set up through docker, the containers volumes are globally set to only have access to my media storage. Assuming that my setup is insecure, wouldn’t that just mean that “hackers” would only be able to stream free media from my server?

source
- jagged_circle@feddit.nl ⁨2⁩ ⁨weeks⁩ ago
  Or you become part of a bonnet and attack your own government’s military. Then you get some very angry knocks on your door and a black back over your face.
  
  And, if you’re brown, probably some electrodes on your genitals until you confess.
  
  source
  - KairuByte@lemmy.dbzer0.com ⁨2⁩ ⁨weeks⁩ ago
    This isn’t happening. The government understand what a botnet is, and if tens or hundreds of thousands of compromised machines are involved, they aren’t coming after you for being part of the attack.
    
    They might send you mail telling you to take care of your shit though.
    
    source
    -> View More Comments
jagged_circle@feddit.nl ⁨2⁩ ⁨weeks⁩ ago
PluginsController only requires user privileges for potentially sensitive actions

Includes, but is not limited to: Listing all plugins on the server without being admin, changing plugin settings, listing plugin settings without being admin. This includes the possibility of retrieving LDAP access credentials without admin privileges.

Outch
source
walden@sub.wetshaving.social ⁨3⁩ ⁨weeks⁩ ago
I’m not smart, can you tell me if having it behind a reverse proxy with certs and everything fixes any of these flaws?

source
- beek@beehaw.org ⁨3⁩ ⁨weeks⁩ ago
  Many of the issues are related to unauthenticated requests. Even though your reverse proxy provides SSL, Jellyfin still won’t know the difference between you and a random internet user. So, no, your setup doesn’t mitigate the security risks much at all.
  
  source
- spit_evil_olive_tips@beehaw.org ⁨3⁩ ⁨weeks⁩ ago
  short answer: no, not really
  
  long answer, here’s an analogy that might help:
  
  you go to https://yourbank.com and log in with your username and password. you click the button to go to Online Bill Pay, and tell it to send ACME Plumbing $150 because they just fixed a leak under your sink.
  
  when you press “Send”, your browser does something like send a POST request to https://yourbank.com/send-bill-payment with a JSON blob like {“account_id”: 1234567890, “recipient”: “ACME Plumbing”, “amount”: 150.0} (this is heavily oversimplified, no actual online bank would work like this, but it’s close enough for the analogy)
  
  and all that happens over TLS. which means it’s “secure”. but security is not an absolute, things can only be secure with a particular threat model in mind. in the case of TLS, it means that if you were doing this at a coffee shop with an open wifi connection, no one else on the coffeeshop’s wifi would be able to eavesdrop and learn your password.
  
  (if your threat model is instead “someone at the coffeeshop looking over your shoulder while you type in your password”, no amount of TLS will save you from that)
  
  but with the type of vulnerability Jellyfin has, someone else can simply send their own POST request to https://yourbank.com/send-bill-payment with {“account_id”: 1234567890, “recipient”: “Bob’s Shady Plumbing”, “amount”: 10000.0}. and your bank account will process that as you sending $10k to Bob’s Shady Plumbing.
  
  that request is also over TLS, but that doesn’t matter, because that’s security for a different level of the stack. the vulnerability is that you are logged in as account 1234567890, so you should be allowed to send those bill payment requests. random people who aren’t logged in as you should not be able to send bill payments on behalf of account 1234567890.
  
  source
- Mora@pawb.social ⁨3⁩ ⁨weeks⁩ ago
  Not really, no. These are application flaws. Caddy will happily do its job and just let bad actors abuse them. (Unless you mean mTLS certs, then Caddy would only respond to those having a client certificate, which hopefully reduces the number of bad actors to your users😉)
  
  source
- Zozano@aussie.zone ⁨3⁩ ⁨weeks⁩ ago
  I’m also an absolute dumbfuck. And I can confidently tell you, as a matter of fact, that I don’t know.
  
  I’m running SWAG reverse proxy, my DNS is not tunneled, I share my Jellyfin with others outside my network.
  
  My primary concern is my server gets hacked, or I get charged with distributing ‘public domain movies’
  
  source
  - Flax_vert@feddit.uk ⁨2⁩ ⁨weeks⁩ ago
    Hacking, even on an insecure system, would be illegal. Any copyright troll trying to sue a single user for having a private jellyfin instance which they hacked to find out about would probably have a hard time actually making a case.
    
    “Yeah, this one guy was distributing films to himself and a few friends. I know because I hacked him” doesn’t seem like a good case.
    
    source
- mark@social.cool110.xyz ⁨3⁩ ⁨weeks⁩ ago
  @walden @Scary_le_Poo Only if the reverse proxy has its own login on top of Jellyfin's, and even that only mitigates some of them.
  source
HurlingDurling@lemm.ee ⁨2⁩ ⁨weeks⁩ ago
Honestly, is the problem that they need extra hands to fix these issues?

source
KingThrillgore@lemmy.ml ⁨2⁩ ⁨weeks⁩ ago
Use a VPN

source
Emmie@lemm.ee ⁨3⁩ ⁨weeks⁩ ago
I think you can IP block who can access it no?

source
- jherazob@beehaw.org ⁨2⁩ ⁨weeks⁩ ago
  Wrong use case, the expected one is friends and family watching stuff on your Jellyfin server from different homes, potentially through mobile, all with dynamic IPs
  
  source
  - unbuckled@lemm.ee ⁨2⁩ ⁨weeks⁩ ago
    Perfect use for allowlisting based on dynamic DNS hostnames.
    
    source
    -> View More Comments
- Scary_le_Poo@beehaw.org ⁨2⁩ ⁨weeks⁩ ago
  Does your friend have a static IP? Unlikely considering that you have to pay extra for a static IP.
  
  source
  - BCsven@lemmy.ca ⁨2⁩ ⁨weeks⁩ ago
    We are lucky, we get two free. Technically they aren’t true static, its tied to MAC of your modem, or your router(s) – with ISP modem in bridge mode. You can pay for true static, but I have probably had the same IP for 5 years, and same with the modem/routerbeforre this one.
    
    source
  - mark@social.cool110.xyz ⁨2⁩ ⁨weeks⁩ ago
    @Emmie @Scary_le_Poo That depends on the ISP, there's still some out there that will give you one for free.
    source
Flax_vert@feddit.uk ⁨2⁩ ⁨weeks⁩ ago
So what’s the alternative? VPNs are unreliable

source
- unbuckled@lemm.ee ⁨2⁩ ⁨weeks⁩ ago
  Unreliable how?
  
  source
  - Flax_vert@feddit.uk ⁨2⁩ ⁨weeks⁩ ago
    Possibly some ISP interference with the OpenVPN protocol. Apparently that can happen sometimes
    
    source
    -> View More Comments
- ReversalHatchery@beehaw.org ⁨2⁩ ⁨weeks⁩ ago
  wireguard has been going fine here for 5+ years. only problems were when that garbage raspberry crashed as it always does (but that’s an issue with the hardware) and when the IP changes, but that’s mitigated by dynamic DNS
  
  source