CVE-2024-47828

Executive Summary

CVE-2024-47828 is a Cross-Site Request Forgery (CSRF) vulnerability in Ampache, a web-based audio/video streaming application and file manager. The flaw allows an attacker to force authenticated users to unknowingly delete objects such as playlists, smartlists, or other user-owned resources. The attack requires no special privileges beyond tricking an authenticated user into visiting a malicious page or clicking a crafted link. With a CVSS score of 5.3 (Medium), the vulnerability primarily impacts data integrity, as an attacker can delete arbitrary playlists or similar objects without the victim’s consent. No public exploit code or proof-of-concept has been released, and the vendor has not yet provided a patch. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for unpatched instances.

Supply Chain & Package Security

Ampache is a PHP-based application typically deployed via manual installation or Docker images. No official package manager (NPM, PyPI, Go, Ruby) is involved. However, administrators should verify the integrity of their Ampache installation files and ensure no unauthorized modifications have been made. The lack of a CSRF token in deletion endpoints is the root cause, and until a patch is released, manual mitigation is required.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to craft a malicious request.
• Privileges Required (PR): None (N) – The attacker does not need to be authenticated.
• User Interaction (UI): Required (R) – The victim must be tricked into clicking a link or visiting a malicious page while authenticated.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): Low (L) – Only specific objects (playlists, smartlists) can be deleted.
• Availability (A): None (N) – No denial-of-service impact.

Threat Level: Medium. The attack requires user interaction and only affects data integrity, but the lack of a patch increases risk for unpatched instances.

Deep Dive & Mechanics

The vulnerability resides in the object deletion functionality of Ampache. When an authenticated user deletes a playlist or smartlist, the application does not validate a CSRF token or enforce a same-origin policy. An attacker can craft a malicious HTML page or script that, when visited by an authenticated user, automatically submits a deletion request to the Ampache server. The request includes the target object ID (e.g., playlist ID) which the attacker can guess or enumerate.

Attack Flow:

1. The attacker identifies a target Ampache instance and obtains a valid playlist ID (e.g., via enumeration or social engineering).
2. The attacker creates a malicious page containing an auto-submitting form or an XMLHttpRequest targeting the deletion endpoint (e.g., /playlist.php?action=delete&playlist_id=123).
3. The attacker lures an authenticated user to visit the malicious page (e.g., via phishing email or forum post).
4. The victim’s browser sends the request with their session cookies, and the server deletes the playlist without verifying the request’s origin.

Root Cause: Missing CSRF protection on deletion endpoints. The application does not implement anti-CSRF tokens, referrer header checks, or same-site cookie attributes.

Vulnerable vs. Patched Code

Since no official patch is available, the following comparison is based on expected secure implementation.

Vulnerable Code (PHP):

// playlist.php (vulnerable)
if ($_GET['action'] == 'delete' && isset($_GET['playlist_id'])) {
    $playlist_id = (int)$_GET['playlist_id'];
    // No CSRF check
    $playlist = new Playlist($playlist_id);
    $playlist->delete();
}

Patched Code (Expected):

// playlist.php (patched)
session_start();
if ($_GET['action'] == 'delete' && isset($_GET['playlist_id'])) {
    // Validate CSRF token
    if (!isset($_GET['csrf_token']) || $_GET['csrf_token'] !== $_SESSION['csrf_token']) {
        die('CSRF validation failed');
    }
    $playlist_id = (int)$_GET['playlist_id'];
    $playlist = new Playlist($playlist_id);
    $playlist->delete();
}

The patched version generates a unique CSRF token per session and validates it on every state-changing request.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A target Ampache instance (e.g., running locally or in a lab).
• A valid playlist ID (e.g., 1).
• An authenticated user session.

Step 1: Craft Malicious HTML Page

<html>
<body>
<form id="csrf_form" action="http://target-ampache/playlist.php" method="GET">
    <input type="hidden" name="action" value="delete">
    <input type="hidden" name="playlist_id" value="1">
</form>
<script>
    document.getElementById('csrf_form').submit();
</script>
</body>
</html>

Step 2: Host the Page

• Serve the HTML file on an attacker-controlled server (e.g., using Python: python3 -m http.server 8080).

Step 3: Lure Victim

• Send the victim a link to the malicious page (e.g., http://attacker.com/csrf.html).
• Ensure the victim is already authenticated to the Ampache instance.

Step 4: Verify Deletion

• Check that the playlist with ID 1 is deleted from the victim’s account.

Blue Team (Defense & Detection)

Mitigation Steps:

1. Implement CSRF Tokens: Add a unique, per-session token to all state-changing forms and validate on the server.
2. SameSite Cookies: Set SameSite=Lax or Strict on session cookies to prevent cross-origin submission.
3. Referrer Header Check: Validate the Referer header to ensure requests originate from the same origin.
4. User Confirmation: Require explicit user confirmation (e.g., “Are you sure you want to delete this playlist?”) before deletion.

Detection:

• Monitor for unusual deletion requests (e.g., multiple deletions in a short time).
• Log and alert on requests to deletion endpoints without a valid CSRF token.

Indicators of Compromise (IOCs)

• Network: HTTP GET requests to /playlist.php?action=delete&playlist_id=<id> without a Referer header matching the Ampache domain.
• Logs: Server access logs showing deletion requests from unexpected origins (e.g., Referer: http://attacker.com/).
• Application: Missing CSRF token in POST/GET parameters for deletion actions.

Detection Engineering

YARA Rule

rule CVE_2024_47828_CSRF_Delete {
    meta:
        description = "Detects CSRF attempts targeting Ampache playlist deletion"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-47828"
    strings:
        $delete_action = "action=delete" nocase
        $playlist_param = "playlist_id=" nocase
        $csrf_token = "csrf_token=" nocase
    condition:
        $delete_action and $playlist_param and not $csrf_token
}

Sigma Rule

title: Ampache CSRF Playlist Deletion Attempt
id: 8a3f2c1e-5d7b-4a9f-8c6e-2b1d3f4a5e6c
status: experimental
description: Detects HTTP requests to Ampache deletion endpoints without CSRF token
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains: '/playlist.php'
        cs-uri-query|contains: 'action=delete'
    filter:
        cs-uri-query|contains: 'csrf_token='
    condition: selection and not filter
falsepositives:
    - Legitimate requests from same origin with CSRF token
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47828 Ampache CSRF Playlist Deletion Attempt"; flow:to_server; http.method; content:"GET"; http.uri; content:"/playlist.php"; content:"action=delete"; http.uri; content:"playlist_id="; pcre:"/csrf_token=/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Deletion Endpoints: Temporarily block access to /playlist.php?action=delete via web server rules (e.g., .htaccess or Nginx location block).
2. Add CSRF Protection: Manually patch the application by adding CSRF token validation (see patched code example).
3. Set SameSite Cookies: Configure PHP session cookies with SameSite=Lax in php.ini:

   session.cookie_samesite = "Lax"
   

4. Monitor Logs: Review access logs for suspicious deletion requests.

Long-Term Fix:

• Wait for an official patch from Ampache developers. Monitor the project’s GitHub repository for updates.
• Consider using a Web Application Firewall (WAF) with CSRF protection rules.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.