CVE-2024-51486

What it actually does

Unsanitized user input in the Custom URL - Favicon field allows arbitrary JavaScript to be stored and later executed in the browser context of other users viewing the interface menu.

Why it matters to the business

An attacker who can reach the setting can hijack administrator sessions, steal credentials or media library access tokens, and perform unauthorized actions inside the streaming application.

How an attack unfolds

An authenticated user with access to the interface settings enters a JavaScript payload as the favicon URL value. The payload is persisted without sanitization. When any user loads the affected page the script executes in their browser, enabling session theft or further actions.

How to fix it

Upgrade ampache/ampache to commit 312765c0cc5e12a4208b70d2739a021be144230d or later release 7.0.1; no workarounds exist.

How to confirm the fix worked

After upgrade, attempt to save a test string containing script tags in the favicon field and confirm the tags are escaped or rejected on subsequent page loads; review application changelog for the referenced commit.

Typical attack path

1. Obtain credentials for an account permitted to modify interface settings
2. Navigate to the Custom URL - Favicon configuration field
3. Submit a payload containing executable JavaScript
4. Wait for or lure another user to load the interface page
5. Capture session cookies or tokens via the executed script

How to detect it

Search web server and application logs for POST requests containing the favicon configuration endpoint; inspect database or configuration storage for favicon URL values that contain script, img, or onerror attributes; review browser console or proxy logs for unexpected JavaScript execution on the interface pages.

What your security team should do

• Immediately upgrade all Ampache instances to the fixed commit or version 7.0.1
• Audit administrator accounts and rotate any sessions that may have loaded the interface page since publication
• Add web application firewall rules that block common script patterns in URL parameters until patching is complete