An authenticated SSRF vulnerability in Movary allows attackers to perform internal network reconnaissance and potentially access sensitive metadata services.

The application fails to restrict user-controlled URLs in the POST /settings/jellyfin/server-url-verify endpoint, enabling an authenticated user to force the server to initiate requests to arbitrary internal targets. This Server-Side Request Forgery (SSRF) flaw allows for internal port scanning, service fingerprinting, and interaction with internal administrative or cloud metadata endpoints.

Successful exploitation allows an attacker with standard user privileges to bypass network perimeters and gain visibility into the internal infrastructure. Given the CVSS score of 7.7, this is a high-severity risk that could lead to the exposure of internal services, credentials, or cloud environment configurations, significantly increasing the probability of a broader system compromise.

Immediate Action: Upgrade Movary to version 0.71.1 or later to implement necessary input validation and request restrictions.

Proactive Monitoring: Review web server access logs for anomalous POST requests to the /settings/jellyfin/server-url-verify endpoint, specifically looking for requests targeting private IP ranges or internal hostnames.

Compensating Controls: Implement network-level egress filtering to prevent the application server from initiating connections to sensitive internal segments or cloud provider metadata endpoints (e.g., 169.254.169.254).

Public Exploit Available: Unknown

Organizations utilizing Movary must prioritize updating to version 0.71.1 immediately to eliminate the SSRF vector. Because this vulnerability allows an authenticated attacker to pivot into the internal network, it poses a significant threat to internal service integrity and should be addressed without delay.