twonky-server-exposure: Twonky Server - Exposure

2025-08-01 Twonky Server PoC Public

Description

Twonky Server is a media server software that allows streaming of multimedia content over DLNA/UPnP protocols. When exposed to the internet or an untrusted network without proper authentication or access restrictions, it may allow unauthorized users to browse and access media files, interact with server settings, or gather sensitive network information.

PoC

id: twonky-server-exposure

info:
  name: Twonky Server - Exposure
  author: DhiyaneshDk
  severity: high
  description: |
    Twonky Server is a media server software that allows streaming of multimedia content over DLNA/UPnP protocols. When exposed to the internet or an untrusted network without proper authentication or access restrictions, it may allow unauthorized users to browse and access media files, interact with server settings, or gather sensitive network information.
  reference:
    - https://lynxtechnology.com/twonky-server.html
    - https://download.twonky.com/
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.favicon.hash:-915768386
  tags: twonky,exposure,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - "contains_all(body, '<title>TwonkyMedia</title>','Settings')"
          - "status_code == 200"
        condition: and
# digest: 4a0a0047304502204c70ea857f08f55e419a7a497f09223e384b21a8864bb99194855bf96abb4018022100e13446309f28456266d3c833222d7d5479d2ff1c4cdac4b99c2f1eb87d58f44d:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/misconfiguration/twonky-server-exposure.yaml

References

Related Vulnerabilities