CVE-2024-53275mediumCWE-350

CVE-2024-53275: medium-severity vulnerability in xemle home-gallery

GHSL-2024-091: DNS rebinding attack in home-gallery

Published · Updated

Follow this CVE+ Monitor home-gallery

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.3%
In short

Home-Gallery is vulnerable to DNS rebinding attacks when set up without TLS and authentication (default configuration). An attacker can trick a user into visiting a malicious website that redirects to the victim's local Home-Gallery instance to steal photos without permission.

Technical detail

DNS rebinding vulnerability in Home-Gallery 1.15.0 and earlier exploits the default lack of TLS and authentication. The attacker manipulates DNS records to redirect requests from their domain to the victim's internal Home-Gallery IP address, then extracts photo data via the unauthenticated API. The attack requires user interaction (visiting the attacker's website) but bypasses same-origin policy protections.

Summary generated and translated by AI from the official description.
Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. In 1.15.0 and earlier, the default setup of home-gallery is vulnerable to DNS rebinding. Home-gallery is set up without TLS and user authentication by default, leaving it vulnerable to DNS rebinding. In this attack, an attacker will ask a user to visit their website. The attacker website will then change the DNS records of their domain from their IP address to the internal IP address of the home-gallery instance. To tell which IP addresses are valid, we can rebind a subdomain to each IP address we want to check, and see if there is a response. Once potential candidates have been found, the attacker can launch the attack by reading the response of the web server after the IP address has changed. When the attacker domain is fetched, the response will be from the home-gallery instance, not the attacker website, because the IP address has been changed. Due to a lack of authentication, home-gallery photos can then be extracted by the attacker website.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
xemle · home-gallery
Related CVEs — xemle home-gallery

In the same product, most dangerous first.

CVE-2024-53276MEDIUMGHSL-2024-092: Open CORS policy in home-galleryEPSS 0.6%CVE-2026-28679HIGHHomeGallery: Path Traversal (Arbitrary File Read)EPSS 0.5%