CVE-2024-51484 Overview
CVE-2024-51484 affects Ampache, a web-based audio and video streaming application with integrated file management. The vulnerability stems from improper Cross-Site Request Forgery (CSRF) token validation during controller activation and deactivation operations. An attacker can craft malicious requests that trigger administrative feature changes when an authenticated user visits an attacker-controlled page. The flaw is classified under CWE-352: Cross-Site Request Forgery. Ampache version 7.0.0 is confirmed affected, and the maintainers released a fix in version 7.0.1.
Critical Impact
Attackers can manipulate site-wide administrative controller settings through forged requests, altering functionality that should be restricted to administrators.
Affected Products
- Ampache 7.0.0
- Ampache installations prior to 7.0.1
- Self-hosted Ampache streaming servers exposed to authenticated web sessions
Discovery Timeline
- 2024-11-11 - CVE-2024-51484 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-51484
Vulnerability Analysis
Ampache exposes administrative endpoints that enable or disable application controllers, which manage site features. The token parsing logic responsible for verifying CSRF tokens on these endpoints does not enforce validation correctly. As a result, requests that lack a valid anti-CSRF token still proceed to modify controller state. An attacker who lures an authenticated administrator to a crafted page can silently trigger these state-changing requests using the victim's session cookies.
The issue is limited in scope to controller activation and deactivation flows, which explains the partial confidentiality, integrity, and availability impacts assessed in the advisory. Exploitation does not require the attacker to authenticate directly but does require an authenticated victim with sufficient privileges to interact with the malicious content.
Root Cause
The root cause is missing or improperly implemented CSRF token verification in the controller management request handler. The parsing routine accepts requests without confirming that the submitted token matches the session-bound token expected by the server. This defect maps directly to CWE-352.
Attack Vector
Exploitation occurs over the network. An attacker hosts a malicious page containing an HTML form, image tag, or JavaScript that issues a request to the vulnerable Ampache endpoint. When an authenticated administrator visits the page, the browser attaches session cookies and the request executes with the victim's privileges. The attacker cannot read the response but can toggle controllers, altering available site features.
No verified proof-of-concept code has been published. See the GitHub Security Advisory GHSA-h6vj-6rvc-3x29 for maintainer details.
Detection Methods for CVE-2024-51484
Indicators of Compromise
- Unexpected changes to enabled or disabled controllers in the Ampache administrative configuration.
- Web server access logs showing state-changing POST or GET requests to controller management endpoints originating from external Referer headers.
- Administrative audit trail entries that do not correspond to a legitimate admin session or maintenance window.
Detection Strategies
- Review Ampache application logs for controller activation and deactivation events, correlating them with authenticated admin sessions.
- Deploy web application firewall (WAF) rules that inspect requests to Ampache admin routes for missing or mismatched CSRF tokens.
- Compare current controller configuration state against a known-good baseline to detect unauthorized modifications.
Monitoring Recommendations
- Alert on HTTP requests to Ampache administrative endpoints that carry cross-origin Referer or Origin headers.
- Monitor for spikes in requests to controller management URLs, especially outside of normal administrative activity windows.
- Log and review all changes to Ampache configuration files or database tables that store controller state.
How to Mitigate CVE-2024-51484
Immediate Actions Required
- Upgrade all Ampache installations to version 7.0.1 or later, which contains the maintainer's fix.
- Audit current controller configurations and revert any unauthorized changes identified during log review.
- Rotate administrative session cookies and require administrators to re-authenticate after upgrading.
Patch Information
The Ampache maintainers addressed the issue in version 7.0.1. Details are published in GitHub Security Advisory GHSA-h6vj-6rvc-3x29. Administrators should apply the upstream release rather than backporting individual patches.
Workarounds
- No official workarounds exist; upgrading to version 7.0.1 is the only supported remediation.
- As a compensating control, restrict access to the Ampache administrative interface using network-level access control lists or a reverse proxy that enforces same-origin request policies.
- Instruct administrators to use a dedicated browser profile for Ampache administration and to log out immediately after configuration changes.
# Upgrade Ampache to the patched release
cd /path/to/ampache
git fetch --tags
git checkout 7.0.1
# Follow the project's standard upgrade procedure to update dependencies and run migrations
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
