CVE-2024-51144
📋 TL;DR
This CSRF vulnerability in Ampache allows attackers to trick authenticated users into performing unintended actions by sending malicious requests. It affects users of Ampache versions up to 6.6.0 who are logged into the application.
💻 Affected Systems
- Ampache
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers could delete user messages, add malicious messages, or manipulate user follow relationships without the victim's knowledge or consent.
Likely Case
Unauthorized message deletion or creation, manipulation of user relationships, and potential data integrity issues.
If Mitigated
Limited impact with proper CSRF protections, though some functionality might be temporarily disrupted.
🎯 Exploit Status
Exploitation requires social engineering to trick authenticated users into visiting malicious pages.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version > 6.6.0
Vendor Advisory: https://github.com/ampache/ampache
Restart Required: No
Instructions:
1. Update Ampache to version > 6.6.0
2. Verify the update completed successfully
3. Test affected endpoints to ensure CSRF protection is in place
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd CSRF tokens to the vulnerable endpoints to validate requests
🧯 If You Can't Patch
- Implement web application firewall rules to block suspicious requests to affected endpoints
- Restrict access to Ampache interface to trusted networks only
🔍 How to Verify
Check if Vulnerable:
Check if Ampache version is <= 6.6.0 and test endpoints for CSRF protectionCheck Version:
Check Ampache web interface or configuration files for version informationVerify Fix Applied:
Verify version is > 6.6.0 and test that affected endpoints now require CSRF tokens📡 Detection & Monitoring
Log Indicators:
- Multiple failed CSRF token validations
- Unusual patterns of requests to pvmsg.php or ajax.server.php endpoints
Network Indicators:
- Requests to vulnerable endpoints without proper referrer headers or CSRF tokens
SIEM Query:
source="ampache" AND (uri="*pvmsg.php*" OR uri="*ajax.server.php*") AND NOT csrf_token=*