CVE-2024-47062: Navidrome Music Server SQLi Vulnerability

CVE-2024-47062 Overview

Navidrome is an open source web-based music collection server and streamer. The application automatically maps URL parameters into SQL queries without proper escaping or sanitization. This design flaw introduces three distinct issues: an Object-Relational Mapping (ORM) leak that lets attackers brute-force sensitive columns like password, a SQL Injection through unescaped parameter names, and an authentication bypass caused by the username being placed inside a LIKE clause. An authenticated attacker with low privileges can chain these behaviors to dump database contents. The issue affects all versions prior to 0.53.0 and is tracked under [CWE-89].

Critical Impact

Authenticated attackers can leak arbitrary database contents, brute-force encrypted passwords character by character, and log in using % wildcards in place of a valid username.

Affected Products

• Navidrome versions prior to 0.53.0
• Navidrome web-based music streaming server
• Deployments exposing the Subsonic-compatible API endpoints

Discovery Timeline

• 2024-09-20 - CVE-2024-47062 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47062

Vulnerability Analysis

The vulnerability stems from Navidrome's request handler passing arbitrary URL query parameters directly into SQL query construction. When a client submits parameters, the backend appends them into a LIKE clause tied to matching column names. An attacker can therefore probe columns not intended to be user-searchable, such as password, by supplying values like password=AAA%. The server responds differently depending on whether the pattern matches, enabling a blind oracle for brute-forcing encrypted password material one character at a time.

The second flaw involves parameter names themselves. Navidrome does not escape the parameter name before concatenating it into the query string, which allows arbitrary SQL fragments to be injected through the key rather than the value. The third flaw places the supplied username into a LIKE expression during authentication, so a value of % matches every stored account and enables login as an arbitrary user when combined with a known or guessable password.

Root Cause

The root cause is unsafe reflection of HTTP query parameters into ORM filters. Both parameter keys and values are trusted, and no allow-list restricts which database columns can be queried. Sensitive columns such as password remain reachable through the same interface used for benign fields like title or artist.

Attack Vector

Exploitation requires network access to the Navidrome HTTP API and low-privilege authenticated credentials. An attacker issues crafted requests to standard listing endpoints, appending parameters that map to sensitive columns or that embed SQL syntax within parameter names. See the GitHub Security Advisory GHSA-58vj-cv5w-v4v6 for the full technical write-up.

Detection Methods for CVE-2024-47062

Indicators of Compromise

• HTTP requests to Navidrome API endpoints containing parameters named password, encrypted_password, or other non-standard column names.
• URL query strings where parameter names contain SQL metacharacters such as single quotes, spaces, --, or UNION.
• Authentication requests using % or other LIKE wildcards in the u or username field.
• Bursts of near-identical requests with incrementing single-character suffixes, consistent with blind brute-force enumeration.

Detection Strategies

• Inspect Navidrome access logs for query parameters not defined in the Subsonic API specification.
• Alert on repeated 200-response requests to /rest/ or /api/ endpoints that differ only by a trailing character in a value.
• Deploy a Web Application Firewall (WAF) rule blocking parameter names that contain characters outside [a-zA-Z0-9_].

Monitoring Recommendations

• Forward Navidrome and reverse-proxy logs to a centralized SIEM for correlation and long-term retention.
• Baseline normal parameter usage and flag deviations, including requests referencing password-related fields.
• Monitor login endpoints for successful authentications where the submitted username contains wildcard characters.

How to Mitigate CVE-2024-47062

Immediate Actions Required

• Upgrade Navidrome to version 0.53.0 or later on every deployment.
• Rotate all Navidrome user passwords and any credentials reused elsewhere, as encrypted values may have been brute-forced.
• Restrict Navidrome network exposure to trusted networks or place it behind an authenticating reverse proxy until patched.
• Audit accounts and sessions for anomalous access following the disclosure date.

Patch Information

The vendor addressed all three issues in Navidrome release 0.53.0. The fix escapes parameter names, restricts which columns can be filtered through URL parameters, and replaces the vulnerable LIKE comparison in the authentication path with an exact match. Refer to the GitHub Security Advisory for release details.

Workarounds

• No vendor-supplied workarounds exist; upgrading to 0.53.0 is required.
• As an interim compensating control, place a reverse proxy in front of Navidrome that strips unknown query parameters and rejects wildcard characters in login fields.

# Upgrade Navidrome via Docker to a patched release
docker pull deluan/navidrome:0.53.0
docker stop navidrome && docker rm navidrome
docker run -d --name navidrome \
  -p 4533:4533 \
  -v /path/to/data:/data \
  -v /path/to/music:/music:ro \
  deluan/navidrome:0.53.0