Movary vulnerabilities

Movary (a self-hosted web app to track and rate watched movies) prior to version 0.71.1 allows an ordinary authenticated user to trigger server-side requests to arbitrary internal targets through POST /settings/jellyfin/server-url-verify. The endpoint accepts a user-controlled URL, appends /system/info/public, and sends a server-side HTTP request with Guzzle without restrictions on internal hosts, loopback addresses, or private network ranges. This enables SSRF and internal network probing, including host discovery, port-state probing, and service fingerprinting.

Movary, a web application to track, rate and explore movie watch history, prior to 0.69.0 accepts a redirect parameter without validation on the login page, allowing attackers to redirect authenticated users to arbitrary external sites. This vulnerability is fixed in 0.69.0.

Movary, a web application to track, rate and explore movie watch history, up to version 0.68.0 uses the HTTP Referer header value directly for redirects in multiple settings endpoints, allowing a crafted link to cause an open redirect to an attacker-controlled site and facilitate phishing. This vulnerability is fixed in 0.69.0.