CVE-2024-41665
📋 TL;DR
Ampache versions before 6.6.0 contain a stored cross-site scripting (XSS) vulnerability in the Democratic Playlist configuration feature. An attacker with Content Manager permissions can inject malicious scripts that execute when administrators or users access the democratic functionality, potentially stealing session cookies. This affects all Ampache instances running vulnerable versions.
💻 Affected Systems
- Ampache
📦 What is this software?
Ampache by Ampache
⚠️ Risk & Real-World Impact
Worst Case
Attacker steals administrator session cookies, gains full administrative access to the Ampache instance, and potentially compromises the underlying server.
Likely Case
Attacker steals user session cookies, gains unauthorized access to user accounts, and may escalate privileges within the application.
If Mitigated
With proper input validation and output encoding, the XSS payload would be neutralized, preventing script execution.
🎯 Exploit Status
Exploit requires Content Manager permissions; payload example provided in advisory
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.6.0
Vendor Advisory: https://github.com/ampache/ampache/security/advisories/GHSA-cp44-89r2-fxph
Restart Required: Yes
Instructions:
1. Backup your Ampache installation and database. 2. Download Ampache 6.6.0 or later from the official repository. 3. Replace existing files with the new version. 4. Run any database update scripts if required. 5. Restart your web server.
🔧 Temporary Workarounds
Disable Democratic Playlist Feature
allTemporarily disable access to the Democratic Playlist configuration to prevent exploitation
# Remove or restrict access to democratic.php in your web server configuration
Restrict Content Manager Permissions
allReview and reduce the number of users with Content Manager permissions
# Review user permissions in Ampache admin panel
🧯 If You Can't Patch
- Implement strict Content Manager permission reviews and monitoring
- Deploy web application firewall (WAF) with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Check Ampache version in admin panel or via 'grep -r 'AMPACHE_VERSION' config/ampache.cfg.php'Check Version:
grep -r 'AMPACHE_VERSION' config/ampache.cfg.phpVerify Fix Applied:
Verify version is 6.6.0 or higher and test Democratic Playlist configuration with XSS payload📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to democratic.php with script tags
- Multiple failed login attempts followed by Democratic Playlist access
Network Indicators:
- HTTP requests containing <svg onload=alert> patterns to democratic.php
SIEM Query:
source="web_logs" AND uri="*democratic.php*" AND (body="*<svg*" OR body="*onload=*" OR body="*alert(*")