CVE-2024-51485

What it actually does

The token parsing logic for plugin activation and deactivation endpoints does not enforce proper CSRF token validation, allowing forged cross-origin requests to toggle administrative plugin settings.

Why it matters to the business

Attackers can remotely alter core site functionality such as enabling or disabling features that should remain under administrator control, leading to service disruption or unauthorized configuration changes without direct access.

How an attack unfolds

An attacker prepares a crafted HTTP request targeting the plugin toggle endpoints, then delivers it to an authenticated administrator via phishing or a malicious page; the browser submits the request with the administrator's session cookies, bypassing the missing CSRF check and applying the unauthorized plugin state change.

How to fix it

Upgrade ampache/ampache to the fixed commit 312765c0cc5e12a4208b70d2739a021be144230d (version 7.0.1) or later; no workarounds exist.

How to confirm the fix worked

Confirm the deployed commit or version is at or beyond 312765c0cc5e12a4208b70d2739a021be144230d; retest plugin toggle endpoints with cross-origin requests lacking valid tokens to verify rejection.

Typical attack path

1. Identify plugin activation or deactivation endpoints that lack CSRF protection
2. Craft a cross-site request that toggles a chosen plugin without a valid token
3. Deliver the request to an authenticated administrator through phishing or embedded content
4. Administrator's browser automatically includes session credentials and executes the change
5. Attacker observes or confirms the resulting configuration alteration

How to detect it

Examine web server and application logs for POST or GET requests to plugin activation or deactivation endpoints originating from external referrers or lacking expected CSRF tokens; correlate with administrator session activity and unexpected plugin configuration changes.

What your security team should do

• Immediately upgrade all Ampache instances to the patched commit
• Review administrative audit logs for unexpected plugin state changes since publication
• Implement additional CSRF protections or web application firewall rules for plugin endpoints until upgrade is complete
• Educate administrators on recognizing suspicious links that could trigger configuration changes