CVE-2024-25808: Lycheeorg Lychee CSRF Vulnerability

CVE-2024-25808 Overview

CVE-2024-25808 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Lychee version 3.1.6, a self-hosted photo-management web application. The flaw resides in the create new album function, which lacks anti-CSRF token validation. Remote attackers can trick authenticated users into executing unintended state-changing requests, leading to arbitrary code execution within the application context. The weakness is classified under [CWE-352]. According to the NVD, the vulnerability requires user interaction but no privileges, and can be triggered over the network.

Critical Impact

An authenticated Lychee user visiting an attacker-controlled page can be forced to execute arbitrary code through the unprotected album creation endpoint, compromising confidentiality and integrity of hosted media.

Affected Products

• Lychee 3.1.6 (lycheeorg/lychee)
• Earlier Lychee 3.x branches sharing the same album-creation handler
• Self-hosted deployments exposing the Lychee web interface to authenticated users

Discovery Timeline

• 2024-03-22 - CVE-2024-25808 published to NVD
• 2025-05-28 - Last updated in NVD database

Technical Details for CVE-2024-25808

Vulnerability Analysis

Lychee 3.1.6 exposes a create new album endpoint that processes authenticated POST requests without verifying an anti-CSRF token or validating the request origin. An attacker who lures an authenticated administrator or user to a malicious page can submit a forged request from the victim's browser. The browser automatically attaches the session cookie, and the Lychee backend processes the request as legitimate.

Because the album creation flow accepts attacker-controlled input that is later rendered or interpreted by the application, the CSRF can be chained into arbitrary code execution within the Lychee instance. The result is a high-impact compromise of stored data and application integrity, with limited availability impact.

Root Cause

The root cause is missing CSRF protection on a state-changing HTTP endpoint. Lychee 3.1.6 does not enforce same-origin verification, synchronizer tokens, or SameSite cookie restrictions on the album creation handler. Any authenticated session can be abused cross-origin.

Attack Vector

Exploitation requires the victim to be authenticated to a vulnerable Lychee instance and to visit an attacker-controlled web page. The malicious page issues an auto-submitting form or fetch request targeting the album creation endpoint. The victim's browser includes the session cookie, allowing the request to succeed and to deliver a payload that the application later executes.

No verified exploit code or public proof-of-concept is referenced in the NVD record. Technical context is available in the GitHub CVE Issue.

Detection Methods for CVE-2024-25808

Indicators of Compromise

• Album creation requests originating with Referer or Origin headers that do not match the Lychee host
• Newly created albums containing unusual names, script-like payloads, or unexpected metadata fields
• Web server access logs showing POSTs to the album creation endpoint clustered immediately after a user visits an external link
• Unexpected files written to the Lychee uploads directory shortly after album creation events

Detection Strategies

• Inspect HTTP request logs for state-changing POSTs to Lychee endpoints that lack a valid CSRF token parameter
• Correlate user session activity with cross-origin referrers to identify forged submissions
• Alert on Lychee process spawning shells, interpreters, or outbound network connections that deviate from baseline behavior

Monitoring Recommendations

• Forward web server and PHP application logs to a centralized analytics platform for retention and correlation
• Baseline normal album creation rates per user and alert on deviations
• Monitor the Lychee installation directory for unexpected file modifications using file integrity monitoring

How to Mitigate CVE-2024-25808

Immediate Actions Required

• Upgrade Lychee away from version 3.1.6 to the latest supported release that enforces CSRF tokens on all state-changing endpoints
• Restrict access to the Lychee administrative interface using network ACLs, VPN, or reverse-proxy authentication
• Force re-authentication and invalidate existing sessions after upgrading
• Review existing albums and uploaded content for artifacts indicative of prior exploitation

Patch Information

No vendor advisory URL is listed in the NVD record for CVE-2024-25808. Administrators should track upstream fixes through the Lychee GitHub project and the referenced CVE issue. Until a confirmed patched version is deployed, treat all Lychee 3.1.6 instances as vulnerable.

Workarounds

• Place Lychee behind a reverse proxy that enforces SameSite=Strict cookies and validates the Origin header on POST requests
• Require an additional authentication layer such as HTTP Basic auth or SSO in front of the Lychee interface
• Instruct users to log out of Lychee when not actively using it to shrink the CSRF attack window
• Block known-malicious referrers and apply web application firewall rules that require a matching CSRF token on album creation requests

# Example nginx hardening for a Lychee reverse proxy
location / {
    proxy_pass http://127.0.0.1:8080;
    proxy_set_header Host $host;
    proxy_cookie_path / "/; HttpOnly; Secure; SameSite=Strict";

    # Reject cross-origin POSTs to state-changing endpoints
    if ($request_method = POST) {
        set $bad_origin "1";
        if ($http_origin ~* "^https://lychee\.example\.com$") {
            set $bad_origin "0";
        }
        if ($bad_origin = "1") {
            return 403;
        }
    }
}