Cloudanix VulnDB

CVE-2024-47828

Medium · 6.5

CVSS

6.5

EPSS

0.3%

Published

Oct 9, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw lets attackers trick logged-in users into deleting their playlists or similar items without realizing it.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Tampering
Component
Application
Class
CSRF
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Cross-site request forgery allows an attacker to craft a request that, when submitted by an authenticated user, deletes arbitrary objects such as playlists or smartlists belonging to that user.

Why it matters to the business

Authenticated users may lose access to their playlists and other managed objects without their knowledge, resulting in data loss and disruption of streaming or file-management workflows.

How an attack unfolds

An attacker generates a malicious web page or link containing a delete request for a target playlist ID, then tricks an authenticated user into visiting the page or clicking the link while logged in, causing the server to process the forged request and delete the object.

How to fix it

Upgrade org.xwiki.platform:xwiki-platform-web to version 13.6RC1, 13.4.1, or 12.10.9 or later. Implement or verify CSRF tokens on all state-changing endpoints and enforce same-origin checks.

How to confirm the fix worked

Confirm the installed version is at or above one of the listed fixed releases; review application logs and configuration for presence of CSRF protection middleware on delete endpoints.

Typical attack path

  1. Identify a target object ID belonging to another user
  2. Craft a cross-origin HTML form or script that submits a delete request using that ID
  3. Host the malicious page or deliver it via phishing or another social-engineering channel
  4. Wait for an authenticated victim to load the page and submit the request
  5. Server processes the request under the victim's session and deletes the object

How to detect it

Review web-server and application logs for unexpected delete requests originating from external referrers or lacking expected anti-CSRF tokens; look for sudden spikes in object-deletion events tied to individual user sessions.

What your security team should do

  • Apply the listed upgrades immediately across all instances
  • Audit and enable built-in CSRF protections for all mutating operations
  • Educate users on recognizing suspicious links that could trigger authenticated actions

The record

ampache is a web based audio/video streaming application and file manager. A CSRF attack can be performed in order to delete objects (Playlist, smartlist etc.). Cross-Site Request Forgery (CSRF) is an attack that forces authenticated users to submit a request to a Web application against which they are currently authenticated. This vulnerability can be exploited by creating a malicious script with an arbitrary playlist ID belonging to another user. When the user submits the request, their playlist will be deleted. Any User with active sessions who are tricked into submitting a malicious request are impacted, as their playlists or other objects could be deleted without their consent.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:16.04:LTS ampache 0 No fix
Ubuntu:Pro:16.04:LTS ampache 0 No fix

Related vulnerabilities