CVE-2024-51484

What it actually does

Failure to validate CSRF tokens during controller activation or deactivation permits forged cross-origin requests to perform privileged state changes that should be restricted to authenticated administrators.

Why it matters to the business

Attackers can remotely alter core site configuration and features that only administrators should control, leading to service disruption, unauthorized data exposure, or persistent compromise without any user credentials.

How an attack unfolds

An attacker crafts a malicious web page or link containing forged requests targeting the vulnerable controller endpoints; when an authenticated administrator visits the attacker-controlled page, the browser automatically submits the requests with the administrator's session cookies, bypassing the broken token checks and executing the unauthorized actions.

How to fix it

Upgrade ampache/ampache to the commit 312765c0cc5e12a4208b70d2739a021be144230d or later release 7.0.1; no workarounds exist.

How to confirm the fix worked

Confirm the running code contains commit 312765c0cc5e12a4208b70d2739a021be144230d or is version 7.0.1 or newer; verify that activation and deactivation endpoints now reject requests lacking a valid per-session CSRF token.

Typical attack path

1. Identify Ampache instances and locate controller activation/deactivation endpoints
2. Craft a cross-site request that performs the desired administrative action without a valid CSRF token
3. Host the payload on an attacker-controlled site or deliver it via phishing email or chat
4. Induce an authenticated administrator to visit the malicious page while logged into Ampache
5. Browser automatically includes session cookies and submits the forged request, executing the change

How to detect it

Examine web server access logs and application logs for POST or GET requests to controller activation or deactivation endpoints that lack expected CSRF token headers or originate from unexpected referrers; correlate with administrator session activity.

What your security team should do

• Immediately upgrade all Ampache instances to 7.0.1 or the referenced commit
• Review administrative audit logs for unexpected controller state changes since publication
• Enforce least-privilege admin accounts and monitor for anomalous administrative activity