CVE-2024-51487

What it actually does

The flaw is improper validation of CSRF tokens when activating or deactivating catalogs, allowing forged requests to modify administrator-only settings.

Why it matters to the business

Attackers could alter core streaming and file management features without authorization, leading to service disruption or unauthorized configuration changes that affect availability and data access for users.

How an attack unfolds

An attacker creates a malicious webpage containing a crafted request to catalog activation or deactivation endpoints; when an authenticated administrator visits the page, the browser submits the request without proper token validation, executing the change.

How to fix it

Upgrade ampache/ampache (GIT) to the fixed commit 312765c0cc5e12a4208b70d2739a021be144230d (version 7.0.1). No workarounds exist.

How to confirm the fix worked

Confirm deployment of commit 312765c0cc5e12a4208b70d2739a021be144230d, then verify that catalog activation and deactivation endpoints now enforce valid CSRF tokens on all requests.

Typical attack path

1. Locate catalog activation or deactivation endpoints in the application
2. Craft a cross-origin request that omits or bypasses CSRF token checks
3. Host the request on an attacker-controlled site and induce an authenticated administrator to visit it
4. Trigger unauthorized catalog state changes

How to detect it

Inspect web server and application logs for catalog activation or deactivation requests lacking valid referrers or originating from unexpected sources; review audit trails for state changes performed without corresponding legitimate administrative sessions.

What your security team should do

• Immediately upgrade to the fixed version 7.0.1
• Audit recent catalog configuration changes for unauthorized modifications
• Implement additional CSRF protections at the web application firewall level until upgrade is complete