CVE-2023-0606

METADATA VENDOR_NAME: Ampache AFFECTED_VERSION: < 5.5.7 MITRE_TACTIC: T1190 — Exploit Public-Facing Application SHODAN_DORKS: ["http.title:"Ampache"", "ampache", "product:ampache"] CWE_ID: CWE-79 CVSS_VECTOR: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N POC_STATUS: None PATCH_DETAILS: No patch available

Executive Summary

CVE-2023-0606 is a reflected cross-site scripting vulnerability in the Ampache open-source media server software affecting all versions prior to 5.5.7. Enterprise deployments exposing Ampache instances to the internet are at risk of arbitrary script execution in victim browsers. The CVSS 9.3 score and 0.00639 EPSS indicate high severity with moderate exploitation likelihood; no public exploits or patches are currently tracked.

Technical Analysis

The vulnerability belongs to the reflected XSS class, where attacker-controlled input is immediately echoed back in HTTP responses without adequate output encoding or sanitization. Attack surface centers on web-facing endpoints that accept user-supplied parameters and render them in HTML context. Because the CNA title specifies reflected behavior, the flaw triggers only when a crafted request is sent and the response directly includes the payload in executable form. No code-level function names, file paths, or parameter names are disclosed in the NVD description, limiting analysis to the vulnerability class. The absence of patch evidence across tracked sources confirms the issue remains unmitigated in the stated version range.

Exploitation Scenarios

No public PoC available; attack chain is inferred from vulnerability class.

1. Reconnaissance/target identification begins with Shodan or internet-wide scans using product banners matching Ampache instances.
2. The reflected XSS flaw is triggered by crafting a URL containing malicious script content in a request parameter that the application reflects verbatim.
3. Payload execution occurs when the victim loads the link, causing the browser to interpret the reflected content as JavaScript due to missing escaping.
4. Post-exploitation impact includes session hijacking, credential theft, or redirection to malware sites within the victim’s authenticated context.

Impact Assessment

Successful exploitation grants an attacker the ability to execute arbitrary JavaScript in the context of any user who clicks a malicious link, potentially compromising user sessions and sensitive media library data. Blast radius extends to all internet-exposed Ampache installations below version 5.5.7. The CVSS 9.3 score reflects network attack vector, low complexity, no privileges required, and high impact on confidentiality and integrity when scope is changed. Business impact includes data exfiltration, account takeover, and possible lateral movement if administrative accounts are targeted.

Detection Guidance

Sigma Rule

title: Ampache Reflected XSS Attempt
id: 8f3c2a1b-4e5d-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects potential reflected XSS probes against Ampache
logsource:
  category: webserver
detection:
  selection:
    c-uri|contains: 'ampache'
    c-uri-query|contains:
      - '<script'
      - 'onerror='
      - 'javascript:'
  condition: selection
fields:
  - client_ip
  - uri
falsepositives:
  - Legitimate search queries
level: high

YARA Rule

rule Ampache_Reflected_XSS_Probe {
    strings:
        $amp = "ampache" nocase
        $xss1 = /<script[^>]*>/
        $xss2 = /onerror\s*=/
    condition:
        $amp and any of ($xss*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"Ampache Reflected XSS Attempt"; flow:established,to_server; http.uri; content:"ampache"; http.uri; pcre:"/[<>\"'][^>]*?(script|onerror|javascript:)/i"; classtype:web-application-attack; sid:20230606; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [http_request where url.path like "*ampache*" and (url.query like "*<script*" or url.query like "*onerror=*")]

Splunk SPL Query

index=web sourcetype=access_combined uri_path="*ampache*" 
| search uri_query="*<script*" OR uri_query="*onerror=*" OR uri_query="*javascript:*" 
| stats count by src_ip, uri, user_agent

Wazuh OSSEC Rule

<group name="web,appsec,ampache">
  <rule id="100306" level="12">
    <if_sid>31100</if_sid>
    <match>ampache</match>
    <regex>&lt;script|onerror=|javascript:</regex>
    <description>Ampache reflected XSS probe detected</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations include deploying a web application firewall with generic XSS signatures and restricting direct internet access to Ampache instances via network ACLs.
2. Patch/upgrade steps cannot be executed until an official fix is released; monitor the Ampache GitHub repository for version 5.5.7 or later.
3. Long-term hardening requires input validation libraries, Content-Security-Policy headers with strict script-src directives, and regular vulnerability scanning of all exposed web applications.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-0606 https://github.com/ampache/ampache https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0606 No known threat actor campaigns or in-the-wild exploitation recorded in CISA KEV or public sources at time of reporting.