CVE-2024-51485

Executive Summary

CVE-2024-51485 is a Cross-Site Request Forgery (CSRF) vulnerability in Ampache, a web-based audio/video streaming application and file manager. The vulnerability exists in the token parsing mechanism used during plugin activation and deactivation. An attacker can craft a malicious request that, when executed by an authenticated administrator, changes website features that should only be managed by administrators. This can lead to unauthorized configuration changes, potentially compromising the integrity of the Ampache instance. The vulnerability is patched in version 7.0.1. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

Ampache is a PHP-based application. The vulnerability is in the core application code, not in a third-party package. The risk to the supply chain is low, but organizations using Ampache should prioritize upgrading to the patched version.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Calculated: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (Admin must click link)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: High
• Availability Impact: None
• Threat Level: Medium – Exploitation requires social engineering but can lead to significant configuration changes.

Deep Dive & Mechanics

The vulnerability is in the token parsing logic for plugin activation/deactivation. Ampache uses CSRF tokens to protect state-changing actions. However, the implementation fails to properly validate these tokens when processing plugin enable/disable requests. An attacker can forge a request (e.g., via a malicious link or form) that, when visited by an authenticated administrator, will activate or deactivate plugins without the admin's consent.

The root cause is a missing or insufficient check of the CSRF token in the plugin management endpoint. The token is either not validated at all, or the validation logic can be bypassed (e.g., by omitting the token parameter). This allows an attacker to change plugin states, potentially enabling malicious plugins or disabling security-related plugins.

Vulnerable vs. Patched Code

Vulnerable Code (Ampache < 7.0.1):

// In admin/plugins.php or similar
if (isset($_POST['action'])) {
    $plugin_id = $_POST['plugin_id'];
    // Missing CSRF token check
    if ($_POST['action'] == 'activate') {
        activate_plugin($plugin_id);
    } elseif ($_POST['action'] == 'deactivate') {
        deactivate_plugin($plugin_id);
    }
}

Patched Code (Ampache >= 7.0.1):

// In admin/plugins.php or similar
if (isset($_POST['action'])) {
    $plugin_id = $_POST['plugin_id'];
    // CSRF token validation added
    if (!isset($_POST['csrf_token']) || !verify_csrf_token($_POST['csrf_token'])) {
        die('CSRF token validation failed.');
    }
    if ($_POST['action'] == 'activate') {
        activate_plugin($plugin_id);
    } elseif ($_POST['action'] == 'deactivate') {
        deactivate_plugin($plugin_id);
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• An authenticated Ampache admin session.
• The admin must click a crafted link or submit a malicious form.

Exploit Steps:

1. Craft a malicious HTML page that auto-submits a form to the Ampache admin panel.
2. The form targets the plugin management endpoint with action=deactivate and plugin_id=<target_plugin>.
3. Host the page and send the link to the admin (e.g., via email or social engineering).
4. When the admin visits the page, the form is submitted, and the plugin is deactivated.

Example Malicious HTML:

<html>
<body>
<form action="http://target-ampache/admin/plugins.php" method="POST">
    <input type="hidden" name="action" value="deactivate">
    <input type="hidden" name="plugin_id" value="1">
    <input type="submit" value="Click me">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

Blue Team

Detection:

• Monitor for unexpected plugin activation/deactivation events.
• Alert on admin actions that occur without a corresponding CSRF token in logs.
• Use the Sigma rule below to detect missing CSRF tokens in POST requests to plugin management endpoints.

Mitigation:

• Upgrade to Ampache 7.0.1 immediately.
• Implement additional CSRF protections (e.g., SameSite cookies, custom headers).
• Educate administrators about phishing and social engineering risks.

Indicators of Compromise (IOCs)

• Network: POST requests to /admin/plugins.php without a csrf_token parameter.
• Logs: Ampache access logs showing plugin activation/deactivation without a preceding CSRF token generation.
• System: Unexpected changes in plugin status (e.g., security plugins disabled).

Detection Engineering

YARA Rule

rule CVE_2024_51485_CSRF_Ampache {
    meta:
        description = "Detects Ampache plugin management requests missing CSRF token"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-51485"
    strings:
        $action = "action=activate" or "action=deactivate"
        $plugin = "plugin_id="
        $no_token = "csrf_token" nocase
    condition:
        $action and $plugin and not $no_token
}

Sigma Rule

title: Ampache Plugin CSRF Exploitation Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects POST requests to Ampache plugin management without CSRF token
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        c-uri|contains: /admin/plugins.php
        cs-uri-query|contains: 
            - "action=activate"
            - "action=deactivate"
    filter:
        cs-uri-query|contains: "csrf_token"
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions with token
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-51485 Ampache Plugin CSRF Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin/plugins.php"; http_uri;
    content:"action=activate" or content:"action=deactivate";
    pcre:"/csrf_token/";
    reference:cve,2024-51485;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate:

• Upgrade to Ampache version 7.0.1 or later.
• If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block POST requests to /admin/plugins.php that lack a csrf_token parameter.

Long-term:

• Conduct a security audit of all state-changing endpoints in Ampache.
• Implement CSRF tokens using a robust library (e.g., PHP's built-in hash_hmac).
• Enable SameSite cookies (Lax or Strict) for session cookies.
• Add custom headers (e.g., X-CSRF-Token) and validate them server-side.

Workarounds:

• No official workarounds are available. The only fix is to upgrade.

Valters IT
DevSecOps & Cyber Threat Intelligence