CVE-2024-51484

Executive Summary

CVE-2024-51484 is a Cross-Site Request Forgery (CSRF) vulnerability in Ampache, a web-based audio/video streaming application and file manager. The vulnerability exists in the token parsing mechanism when activating or deactivating controllers. An attacker can craft a malicious request that, when executed by an authenticated administrator, changes website features that should only be managed by administrators. This can lead to unauthorized configuration changes, potentially affecting the availability or integrity of the streaming service. The vulnerability is patched in version 7.0.1, and no workarounds are available.

Supply Chain & Package Security

Ampache is a PHP-based application typically deployed via Git or manual download. It is not distributed through NPM, PyPI, Go, or Ruby registries. Therefore, supply chain risks are limited to the integrity of the source code repository and any third-party PHP libraries used. Users should verify the authenticity of their Ampache installation and ensure they are using the official repository.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD base score not assigned, but based on vector: 4.3 Medium)
• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need to be authenticated.
• User Interaction (UI): Required (R) – The victim must click a link or visit a malicious page.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): None (N) – No data disclosure.
• Integrity (I): Low (L) – Limited modification of application settings.
• Availability (A): None (N) – No direct denial of service.

Threat Level: Medium. The attack requires user interaction (admin clicking a link) and only allows modification of controller settings, not full system compromise. However, it can be chained with other vulnerabilities for greater impact.

Deep Dive & Mechanics

The vulnerability lies in the token parsing logic within Ampache's controller activation/deactivation functionality. When an administrator performs an action to enable or disable a controller (e.g., streaming backend, transcoding module), the application checks for a CSRF token to verify the request's legitimacy. However, due to improper validation, the token check can be bypassed or is not enforced for certain actions.

Root Cause: The token parameter is parsed but not validated against the user's session. This allows an attacker to craft a request with a missing or arbitrary token value, and the server will still process the action.

Attack Flow:

1. Attacker identifies a target Ampache instance with an authenticated admin session.
2. Attacker crafts a malicious HTML page or email containing a request to change a controller setting (e.g., disable transcoding).
3. Victim (admin) visits the malicious page while logged into Ampache.
4. The browser sends the forged request, including the victim's session cookie.
5. Ampache processes the request without proper CSRF token validation, changing the controller setting.

Impact: An attacker can disable critical streaming controllers, degrade service quality, or enable insecure controllers, potentially leading to further exploitation.

Vulnerable vs. Patched Code

Vulnerable Code (Ampache < 7.0.1):

// In admin/controllers.php or similar
if (isset($_POST['action']) && $_POST['action'] == 'toggle_controller') {
    $controller_id = $_POST['controller_id'];
    // Missing or weak CSRF token check
    // $token = $_POST['token']; // Not validated
    toggle_controller($controller_id);
}

Patched Code (Ampache 7.0.1):

// In admin/controllers.php
if (isset($_POST['action']) && $_POST['action'] == 'toggle_controller') {
    $controller_id = $_POST['controller_id'];
    $token = $_POST['token'];
    // Validate CSRF token
    if (!validate_csrf_token($token)) {
        die('Invalid CSRF token');
    }
    toggle_controller($controller_id);
}

The patch adds a call to validate_csrf_token() which checks the token against the user's session. This prevents unauthorized requests.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target Ampache instance (version < 7.0.1)
• Admin user must be logged in
• Attacker must be able to deliver a malicious link to the admin

Exploit Steps:

1. Identify the target controller toggle endpoint (e.g., /admin/controllers.php?action=toggle_controller&controller_id=1).
2. Create a malicious HTML page that auto-submits a form to this endpoint.
3. Host the page on an attacker-controlled server.
4. Send the link to the admin via email or social engineering.

Example Malicious HTML:

<html>
<body>
<form action="http://target-ampache/admin/controllers.php" method="POST" id="csrf-form">
    <input type="hidden" name="action" value="toggle_controller">
    <input type="hidden" name="controller_id" value="1">
    <input type="hidden" name="token" value="invalid_or_empty">
</form>
<script>document.getElementById('csrf-form').submit();</script>
</body>
</html>

Note: No public exploit code is available. This is a conceptual demonstration.

Blue Team

Detection:

• Monitor for unusual POST requests to /admin/controllers.php with missing or invalid token parameters.
• Alert on multiple controller toggle actions within a short time frame.
• Use web application firewall (WAF) rules to block requests without a valid CSRF token.

Hunting:

• Search web server logs for POST /admin/controllers.php with action=toggle_controller and no token parameter.
• Correlate with user agent anomalies or referrer headers from unknown domains.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /admin/controllers.php with action=toggle_controller and missing token parameter.
  • Referrer header from an external domain (e.g., attacker-controlled site).
• Host:
  • Unexpected changes in controller configuration (e.g., disabled transcoding, enabled insecure modules).
  • Log entries showing Invalid CSRF token errors (if patched, but may indicate attempted exploitation).
• File:
  • No specific file IOCs; the attack is purely request-based.

Detection Engineering

YARA Rule

rule CVE_2024_51484_CSRF_Ampache {
    meta:
        description = "Detects CSRF exploitation attempts against Ampache controller toggle"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-51484"
    strings:
        $action = "action=toggle_controller"
        $endpoint = "/admin/controllers.php"
        $token_missing = "token="
    condition:
        $action and $endpoint and not $token_missing
}

Sigma Rule

title: Ampache CSRF Token Bypass in Controller Toggle
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP POST requests to Ampache admin controllers.php without a valid CSRF token
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/admin/controllers.php'
        cs-uri-query|contains: 'action=toggle_controller'
    filter:
        cs-uri-query|contains: 'token='
    condition: selection and not filter
falsepositives:
    - Legitimate requests with valid tokens (should be rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-51484 Ampache CSRF Token Bypass Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin/controllers.php"; http_uri;
    content:"action=toggle_controller"; http_client_body;
    pcre:"/token=/";
    reference:cve,2024-51484;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate:

• Upgrade to Ampache version 7.0.1 or later.
• If upgrade is not possible, implement a reverse proxy or WAF rule to block requests to /admin/controllers.php without a valid token parameter.

Long-term:

• Enforce CSRF protection for all state-changing operations.
• Use same-site cookies (Strict or Lax) to mitigate cross-site requests.
• Educate administrators about phishing and social engineering risks.

Workarounds: None officially provided. The only solution is to upgrade.

Report generated by Valters IT DevSecOps AI Assistant