CVE-2024-28852

What it actually does

Reflected cross-site scripting in query forms that accept a rule parameter allows injection of arbitrary JavaScript that executes in the browser of any user who follows a crafted link.

Why it matters to the business

Attackers can steal session tokens, perform actions on behalf of users, or deliver malware to administrators and listeners of the streaming service, increasing risk of account takeover and data exposure.

How an attack unfolds

An attacker crafts a URL containing a malicious payload in the rule parameter for song, podcast, or similar search endpoints and tricks an authenticated user into visiting the link; the application reflects the payload without sanitization, causing the script to run in the victim's session.

How to fix it

Upgrade ampache/ampache to the version containing commit eae313e4e63f0a9b7b14db4d0f39d303a0fee073 or later release 6.3.1; sanitize or encode the rule parameter on all forms before output.

How to confirm the fix worked

Confirm the deployed commit is at or after eae313e4e63f0a9b7b14db4d0f39d303a0fee073; retest rule-parameter endpoints with known XSS payloads to verify they are now escaped or rejected.

Typical attack path

1. Identify a search or listing endpoint that accepts the rule parameter
2. Craft a URL embedding a script payload inside the rule value
3. Deliver the link via email, chat, or another channel to a target user
4. Victim clicks the link while authenticated
5. Browser executes the injected script, enabling session theft or actions

How to detect it

Inspect web access logs for rule= parameters containing HTML tags, event handlers, or javascript: URIs; correlate with subsequent unusual user activity or cookie exfiltration attempts.

What your security team should do

• Apply the fixed commit or 6.3.1 immediately on all instances
• Review web server access logs for rule parameters containing script, onerror, or javascript: patterns
• Add input validation and output encoding for all user-controlled parameters in search forms
• Monitor for unusual administrative actions following visits to search endpoints