3 points | by zm_0x 12 hours ago ago
2 comments
https://zmain.info/blog/plex2shell
Some of those individual bugs are egregious. A guard that doesn't work at all? A /player/timeline endpoint that doesn't check the token value?
I agree. The auth model is the real problem. Plex trusts anything from loopback, so any SSRF is effectively an auth bypass.
https://zmain.info/blog/plex2shell
Some of those individual bugs are egregious. A guard that doesn't work at all? A /player/timeline endpoint that doesn't check the token value?
I agree. The auth model is the real problem. Plex trusts anything from loopback, so any SSRF is effectively an auth bypass.