[–] smallerize 11d ago ↗ https://zmain.info/blog/plex2shellSome of those individual bugs are egregious. A guard that doesn't work at all? A /player/timeline endpoint that doesn't check the token value? [–] zm_0x 11d ago ↗ I agree. The auth model is the real problem. Plex trusts anything from loopback, so any SSRF is effectively an auth bypass.
[–] zm_0x 11d ago ↗ I agree. The auth model is the real problem. Plex trusts anything from loopback, so any SSRF is effectively an auth bypass.
2 comments
[ 0.30 ms ] story [ 14.0 ms ] threadSome of those individual bugs are egregious. A guard that doesn't work at all? A /player/timeline endpoint that doesn't check the token value?