CVE-2024-25808: Lycheeorg Lychee CSRF Vulnerability

CVE-2024-25808 Overview

CVE-2024-25808 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Lychee version 3.1.6, a self-hosted photo-management web application. The flaw resides in the create new album function, which lacks anti-CSRF token validation. Remote attackers can trick authenticated users into executing unintended state-changing requests, leading to arbitrary code execution within the application context. The weakness is classified under [CWE-352]. According to the NVD, the vulnerability requires user interaction but no privileges, and can be triggered over the network.

Critical Impact
An authenticated Lychee user visiting an attacker-controlled page can be forced to execute arbitrary code through the unprotected album creation endpoint, compromising confidentiality and integrity of hosted media.

Affected Products

Lychee 3.1.6 (lycheeorg/lychee)
Earlier Lychee 3.x branches sharing the same album-creation handler
Self-hosted deployments exposing the Lychee web interface to authenticated users

Discovery Timeline

2024-03-22 - CVE-2024-25808 published to NVD
2025-05-28 - Last updated in NVD database

Technical Details for CVE-2024-25808

Vulnerability Analysis

Lychee 3.1.6 exposes a create new album endpoint that processes authenticated POST requests without verifying an anti-CSRF token or validating the request origin. An attacker who lures an authenticated administrator or user to a malicious page can submit a forged request from the victim's browser. The browser automatically attaches the session cookie, and the Lychee backend processes the request as legitimate.

Because the album creation flow accepts attacker-controlled input that is later rendered or interpreted by the application, the CSRF can be chained into arbitrary code execution within the Lychee instance. The result is a high-impact compromise of stored data and application integrity, with limited availability impact.

Root Cause

The root cause is missing CSRF protection on a state-changing HTTP endpoint. Lychee 3.1.6 does not enforce same-origin verification, synchronizer tokens, or SameSite cookie restrictions on the album creation handler. Any authenticated session can be abused cross-origin.

Attack Vector

Exploitation requires the victim to be authenticated to a vulnerable Lychee instance and to visit an attacker-controlled web page. The malicious page issues an auto-submitting form or fetch request targeting the album creation endpoint. The victim's browser includes the session cookie, allowing the request to succeed and to deliver a payload that the application later executes.

No verified exploit code or public proof-of-concept is referenced in the NVD record. Technical context is available in the GitHub CVE Issue.

Detection Methods for CVE-2024-25808

Indicators of Compromise

Album creation requests originating with Referer or Origin headers that do not match the Lychee host
Newly created albums containing unusual names, script-like payloads, or unexpected metadata fields
Web server access logs showing POSTs to the album creation endpoint clustered immediately after a user visits an external link
Unexpected files written to the Lychee uploads directory shortly after album creation events

Detection Strategies

Inspect HTTP request logs for state-changing POSTs to Lychee endpoints that lack a valid CSRF token parameter
Correlate user session activity with cross-origin referrers to identify forged submissions
Alert on Lychee process spawning shells, interpreters, or outbound network connections that deviate from baseline behavior

Monitoring Recommendations

Forward web server and PHP application logs to a centralized analytics platform for retention and correlation
Baseline normal album creation rates per user and alert on deviations
Monitor the Lychee installation directory for unexpected file modifications using file integrity monitoring

How to Mitigate CVE-2024-25808

Immediate Actions Required

Upgrade Lychee away from version 3.1.6 to the latest supported release that enforces CSRF tokens on all state-changing endpoints
Restrict access to the Lychee administrative interface using network ACLs, VPN, or reverse-proxy authentication
Force re-authentication and invalidate existing sessions after upgrading
Review existing albums and uploaded content for artifacts indicative of prior exploitation

Patch Information

No vendor advisory URL is listed in the NVD record for CVE-2024-25808. Administrators should track upstream fixes through the Lychee GitHub project and the referenced CVE issue. Until a confirmed patched version is deployed, treat all Lychee 3.1.6 instances as vulnerable.

Workarounds

Place Lychee behind a reverse proxy that enforces SameSite=Strict cookies and validates the Origin header on POST requests
Require an additional authentication layer such as HTTP Basic auth or SSO in front of the Lychee interface
Instruct users to log out of Lychee when not actively using it to shrink the CSRF attack window
Block known-malicious referrers and apply web application firewall rules that require a matching CSRF token on album creation requests

bash

# Example nginx hardening for a Lychee reverse proxy
location / {
    proxy_pass http://127.0.0.1:8080;
    proxy_set_header Host $host;
    proxy_cookie_path / "/; HttpOnly; Secure; SameSite=Strict";

    # Reject cross-origin POSTs to state-changing endpoints
    if ($request_method = POST) {
        set $bad_origin "1";
        if ($http_origin ~* "^https://lychee\.example\.com$") {
            set $bad_origin "0";
        }
        if ($bad_origin = "1") {
            return 403;
        }
    }
}