CVE-2024-56362
📋 TL;DR
Navidrome versions before 0.54.1 store JWT secrets in plaintext in the database file, allowing anyone with database access to steal authentication tokens. This affects all Navidrome installations using vulnerable versions. Attackers could impersonate users or gain unauthorized access to the music streaming service.
💻 Affected Systems
- Navidrome
📦 What is this software?
Navidrome by Navidrome
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all user accounts, unauthorized access to music libraries, and potential privilege escalation to administrative functions.
Likely Case
Unauthorized access to user accounts and music collections by attackers with database file access.
If Mitigated
Limited impact if database files are properly secured with strict file permissions and access controls.
🎯 Exploit Status
Exploitation requires access to the navidrome.db file. Attack complexity is low once file access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.54.1
Vendor Advisory: https://github.com/navidrome/navidrome/security/advisories/GHSA-xwx7-p63r-2rj8
Restart Required: Yes
Instructions:
1. Backup your current Navidrome installation and database. 2. Download and install Navidrome version 0.54.1 or later. 3. Restart the Navidrome service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Secure Database File Permissions
linuxRestrict access to the navidrome.db file to only the Navidrome service user
chmod 600 /path/to/navidrome.db
chown navidrome:navidrome /path/to/navidrome.db
Database File Encryption
allUse filesystem encryption or database encryption tools to protect the database file
🧯 If You Can't Patch
- Implement strict file permissions on navidrome.db (read/write for service user only)
- Monitor access to the database file and alert on unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check if JWT secret is stored in plaintext in property table: sqlite3 navidrome.db 'SELECT * FROM property WHERE id="jwt.secret";'Check Version:
Check Navidrome web interface or run: navidrome --versionVerify Fix Applied:
After patching, verify the secret is no longer stored in plaintext using the same SQL query📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to database files
- Unexpected SQL queries to property table
Network Indicators:
- Unusual authentication patterns
- Multiple failed login attempts followed by successful access
SIEM Query:
file_access WHERE file_path LIKE '%navidrome.db' AND user NOT IN ('navidrome', 'expected_service_user')