Stealing From Thieves

The talk traces how automated media download setups grew from early peer-to-peer file sharing to Usenet and Docker-based Servarr stacks. It walks through how a media request moves from a request front end such as Overseerr to Radarr or Sonarr, then to indexers managed by Prowlarr, and finally to a download client that reassembles files for a media server like Plex or Jellyfin. The speakers explain that the Servarr applications descend from a shared codebase, so a flaw in one project tends to appear across its forks.

The central finding concerns the "disable for local addresses" authentication option. The initialize.json endpoint returned the administrator API key to anyone whose request appeared to come from a local or private address. The speakers showed that a spoofed X-Forwarded-For header achieved this, because the application trusted it without checking the source. With the key, a database backup could be exported, exposing stored download client credentials, indexer keys, and a media server token. They also scanned for internet-facing instances and gathered library statistics, reporting multi-petabyte collections, while describing their queries as limited to collecting statistics.

The disclosure process was slow, with the lead developer reached through Discord and a patch appearing in the codebase before an formal response. The fix restricts trusted proxy headers to specific IP ranges. The takeaways are to keep these apps off the public internet, require authentication, limit which proxies are trusted, and treat home lab and media infrastructure as part of the attack surface that defenders should inventory.