CVE-2024-51486 Overview
CVE-2024-51486 is a stored Cross-Site Scripting (XSS) vulnerability in Ampache, a web-based audio/video streaming application and file manager. The flaw resides in the interface configuration section of the Ampache menu, specifically in the Custom URL - Favicon field. Ampache fails to sanitize input submitted to this field, allowing an authenticated attacker to inject JavaScript payloads that execute in the browser of any user rendering the affected page. The issue is tracked under [CWE-79] and affects Ampache version 7.0.0. Maintainers addressed the vulnerability in version 7.0.1.
Critical Impact
An authenticated attacker can persist arbitrary JavaScript into the Ampache interface, hijack sessions, and pivot to actions performed by administrators who load the compromised page.
Affected Products
- Ampache 7.0.0
- Ampache instances exposing the interface configuration menu to privileged users
- Deployments that have not upgraded to Ampache 7.0.1 or later
Discovery Timeline
- 2024-11-11 - CVE-2024-51486 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-51486
Vulnerability Analysis
Ampache renders the Custom URL - Favicon value directly into HTML output without sufficient encoding or validation. An attacker with access to the interface settings can supply a string that breaks out of the intended attribute context and injects a <script> tag or event handler. When another user loads a page that includes the favicon reference, the browser executes the attacker-controlled JavaScript in the context of the Ampache origin.
The exploit requires high privileges to modify the interface settings and user interaction to trigger execution on a victim session. Because the payload is stored server-side and reused across pages, the scope changes: code executes with the loaded user's session, enabling account takeover of administrators who visit the affected UI. The vendor advisory documents the affected component and remediation in the GitHub Security Advisory.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79]. The interface configuration handler treats the favicon URL as trusted text and injects it into the DOM without contextual output encoding. Any string containing HTML control characters or JavaScript URI schemes flows through to the rendered page unchanged.
Attack Vector
An authenticated user with permission to change interface settings navigates to the Ampache menu and sets Custom URL - Favicon to a crafted payload containing JavaScript. The payload persists in the server-side configuration store. When any authenticated user, including administrators, loads a page referencing the favicon, the injected script executes in their browser session. Attackers can use this to steal session cookies, perform CSRF-protected actions, or modify Ampache configuration to escalate access.
No verified public exploit code is available. See the vendor advisory for technical details.
Detection Methods for CVE-2024-51486
Indicators of Compromise
- Unexpected values in the Ampache Custom URL - Favicon configuration field containing HTML tags, javascript: URIs, or event handler attributes such as onerror=
- Outbound requests from user browsers to unknown domains shortly after loading Ampache pages
- Ampache audit logs showing interface preference changes by accounts that do not normally administer the platform
Detection Strategies
- Inspect the Ampache database preference and user_preference tables for favicon values that contain <, >, ", ', or script substrings
- Deploy a Content Security Policy (CSP) in report-only mode and review violation reports for inline script execution originating from favicon references
- Review web server access logs for POST requests to interface preference endpoints followed by anomalous GET traffic to attacker-controlled hosts
Monitoring Recommendations
- Alert on modifications to Ampache interface preferences, particularly the favicon URL, by non-administrator accounts
- Monitor browser telemetry from endpoints accessing Ampache for script execution against unexpected external origins
- Track version metadata across Ampache deployments and flag any instance running 7.0.0
How to Mitigate CVE-2024-51486
Immediate Actions Required
- Upgrade all Ampache instances to version 7.0.1 or later, which contains the sanitization fix
- Audit the current Custom URL - Favicon value in every Ampache deployment and reset it to a known-good URL if it contains any HTML or scripting syntax
- Rotate session tokens and administrator credentials on instances where the payload may have executed
Patch Information
Ampache maintainers released version 7.0.1 to address the improper input sanitization in the interface favicon handler. Details are published in the GitHub Security Advisory GHSA-4xw5-f7xm-vpw5. No backported patches are provided for earlier branches; upgrading is the supported remediation path.
Workarounds
- The vendor states there are no known workarounds; upgrading to 7.0.1 is required
- As a compensating control, restrict access to the interface preferences page to a minimal set of trusted administrators
- Deploy a strict Content Security Policy that blocks inline script execution to reduce the impact of any residual stored XSS vectors
# Verify installed Ampache version and upgrade
grep -R "AmpacheConfig\|version" /var/www/ampache/config/ | head
# Upgrade via git
cd /var/www/ampache
git fetch --tags
git checkout 7.0.1
composer install --no-dev
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
