CVE-2024-47184

What it actually does

Stored cross-site scripting vulnerability in the Democratic Playlist Name feature allows persistent injection of malicious scripts that execute in the browsers of users who view the playlist.

Why it matters to the business

Attackers could hijack user sessions, steal credentials, or perform actions on behalf of legitimate users of the streaming application, potentially leading to data exposure or unauthorized access across the platform.

How an attack unfolds

An attacker creates or edits a Democratic Playlist and embeds executable script code inside the playlist name field. The payload is stored on the server without sanitization. When another user loads or views the playlist through the web interface, the browser executes the script in the context of the victim's session.

How to fix it

Upgrade ampache/ampache to version 6.6.0 or apply commit 860592aa10a12cec318ed7eee15ff509b06a5331. Sanitize all user-supplied playlist name inputs on input and output.

How to confirm the fix worked

Confirm the running instance reports version 6.6.0 or later. Test by attempting to create a playlist containing a script tag and verify it is escaped or rejected. Review changelog for the referenced commit.

Typical attack path

1. Identify a Democratic Playlist creation or edit function
2. Submit a playlist name containing HTML/JS payload
3. Ensure the playlist is visible or shared with target users
4. Wait for victims to render the playlist in their browser
5. Execute arbitrary actions via the running script such as session theft or UI manipulation

How to detect it

Search application logs and database records for Democratic Playlist entries containing HTML tags, script elements, or event handlers in the name field. Review web server access logs for requests that include unusual characters in playlist parameters around the time of playlist creation or updates.

• playlist name containing <script
• playlist name containing onerror=
• playlist name containing javascript:

What your security team should do

• Immediately upgrade all Ampache instances to 6.6.0
• Audit existing Democratic Playlists for suspicious names containing script or HTML tags
• Enable content security policy headers to limit script execution impact
• Monitor for new public exploits given the stored nature of the flaw