CVE-2023-51442
📋 TL;DR
This vulnerability allows attackers to bypass authentication in Navidrome's subsonic endpoint using a JWT signed with a hardcoded key. It affects all Navidrome instances running versions before 0.50.2 that haven't been restarted, potentially exposing music collections to unauthorized access.
💻 Affected Systems
- Navidrome
📦 What is this software?
Navidrome by Navidrome
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all user accounts and music collections, allowing attackers to access, modify, or delete sensitive media content.
Likely Case
Unauthorized access to music collections, potentially exposing personal media libraries and metadata.
If Mitigated
Limited impact if subsonic endpoint is properly protected or instance has been restarted.
🎯 Exploit Status
Exploit requires knowledge of target username and uses hardcoded JWT key 'not so secret'.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.50.2
Vendor Advisory: https://github.com/navidrome/navidrome/security/advisories/GHSA-wq59-4q6r-635r
Restart Required: Yes
Instructions:
1. Update Navidrome to version 0.50.2 or later. 2. Restart the Navidrome service. 3. Verify the update was successful.
🔧 Temporary Workarounds
Restart Service
linuxRestarting Navidrome mitigates the vulnerability as it only affects instances that have never been restarted.
sudo systemctl restart navidrome
Protect Subsonic Endpoint
allAdd authentication or restrict access to the /rest/ endpoint via reverse proxy or firewall rules.
🧯 If You Can't Patch
- Restart the Navidrome service immediately
- Implement network-level protection for the /rest/ endpoint
🔍 How to Verify
Check if Vulnerable:
Check if Navidrome version is below 0.50.2 and service hasn't been restarted since installation.Check Version:
navidrome --versionVerify Fix Applied:
Confirm version is 0.50.2 or later and service has been restarted after update.📡 Detection & Monitoring
Log Indicators:
- Authentication attempts with JWT parameter
- Failed authentication followed by successful access
- Unusual access patterns to /rest/ endpoint
Network Indicators:
- HTTP requests to /rest/ with jwt parameter
- Authentication bypass attempts
SIEM Query:
source="navidrome" AND (uri_path="/rest/*" AND query_parameters CONTAINS "jwt")🔗 References
- https://github.com/navidrome/navidrome/commit/1132abb0135d1ecaebc41ed97a1e908a4ae02f7c
- https://github.com/navidrome/navidrome/security/advisories/GHSA-wq59-4q6r-635r
- https://github.com/navidrome/navidrome/commit/1132abb0135d1ecaebc41ed97a1e908a4ae02f7c
- https://github.com/navidrome/navidrome/security/advisories/GHSA-wq59-4q6r-635r
