CVE-2024-51487: Ampache CSRF Vulnerability

CVE-2024-51487 Overview

CVE-2024-51487 is a Cross-Site Request Forgery (CSRF) vulnerability in Ampache, an open-source web-based audio and video streaming application with integrated file management. The flaw resides in the token parsing logic used when activating or deactivating a catalog. The current implementation fails to properly validate CSRF tokens, allowing an attacker to trigger administrative catalog state changes through crafted requests. Exploitation requires an authenticated administrator to visit or interact with a malicious page while logged in. The issue is fixed in Ampache version 7.0.1, and no workarounds exist for affected deployments.

Critical Impact
Attackers can force authenticated administrators to enable or disable Ampache catalogs, altering site functionality without consent.

Affected Products

Ampache 7.0.0
Ampache web-based audio/video streaming application
Ampache file manager component

Discovery Timeline

2024-11-11 - CVE-2024-51487 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-51487

Vulnerability Analysis

Ampache implements CSRF token checks to protect state-changing operations in the administrative interface. The catalog activation and deactivation endpoints, however, do not correctly enforce this validation. Because the token parsing logic fails to reject requests lacking a valid token, an attacker can craft HTML or JavaScript that submits a forged request against these endpoints. When an authenticated administrator loads the malicious content, the browser automatically attaches their session cookies, causing Ampache to process the request as legitimate. The attacker gains the ability to toggle catalog availability, which controls which media libraries are exposed to users of the application.

Root Cause

The vulnerability is classified under CWE-352: Cross-Site Request Forgery. The catalog activation and deactivation handlers rely on a token parsing routine that does not properly compare or require a valid anti-CSRF token before executing the requested state change. This constitutes a missing integrity check on the origin of the request.

Attack Vector

Exploitation is remote and network-based. An attacker hosts a malicious webpage or sends a link that references the vulnerable Ampache endpoint. When an administrator with an active Ampache session visits the page, the browser issues the forged request. No user interaction beyond visiting the attacker-controlled content is required. Successful exploitation modifies catalog state, potentially disabling media availability or enabling catalogs that should remain hidden. Full technical details are documented in the Ampache GitHub Security Advisory GHSA-5rmx-fjmc-mg6x.

Detection Methods for CVE-2024-51487

Indicators of Compromise

Unexpected catalog activation or deactivation events in Ampache administrative logs
HTTP requests to catalog management endpoints with Referer headers pointing to external, untrusted domains
Administrator sessions performing catalog state changes without corresponding console activity

Detection Strategies

Review Ampache application logs for catalog state transitions and correlate them against known administrator actions
Inspect web server access logs for POST or GET requests to catalog activation endpoints originating from unexpected referrers
Enable audit logging on the Ampache administrative interface to capture the full request context of catalog changes

Monitoring Recommendations

Alert on any change to catalog activation state outside of scheduled administrative windows
Monitor for browser sessions where administrators load external content shortly before catalog changes occur
Track HTTP request patterns to /admin/catalog.php and related endpoints for anomalous origins

How to Mitigate CVE-2024-51487

Immediate Actions Required

Upgrade Ampache to version 7.0.1 or later, which contains the CSRF token validation fix
Require administrators to log out of Ampache sessions when not actively managing the application
Restrict administrative interface access to trusted network segments where feasible

Patch Information

The maintainers addressed CVE-2024-51487 in Ampache 7.0.1 by correcting token validation logic on the catalog activation and deactivation handlers. All users running Ampache 7.0.0 should upgrade immediately. See the Ampache GitHub Security Advisory for full remediation details.

Workarounds

No workarounds are available according to the vendor advisory; upgrading to 7.0.1 is the only supported remediation
As a defense-in-depth measure, deploy a reverse proxy or web application firewall rule to enforce Origin and Referer header checks on administrative endpoints
Use browser isolation or dedicated administrator browsers to reduce the risk of CSRF payload delivery

bash

# Example: nginx rule restricting Ampache admin endpoints by Referer
location ~ ^/admin/ {
    if ($http_referer !~* "^https://ampache\.example\.com/") {
        return 403;
    }
    proxy_pass http://ampache_backend;
}