CVE-2024-51488

What it actually does

Insufficient CSRF token validation during message deletion allows forged requests to delete messages for any user including administrators.

Why it matters to the business

Attackers can cause unauthorized deletion of internal messages, disrupting communication and potentially removing critical administrative notices without user consent.

How an attack unfolds

An attacker crafts a malicious web request targeting the message deletion endpoint, hosts it on a site the victim visits while authenticated, and relies on the missing CSRF protections to execute the deletion when the victim interacts with the page.

How to fix it

Upgrade Ampache to version 7.0.1 or apply the fix from commit 312765c0cc5e12a4208b70d2739a021be144230d. No workarounds exist.

How to confirm the fix worked

Confirm the running version is 7.0.1 or later containing commit 312765c0cc5e12a4208b70d2739a021be144230d; re-test message deletion to verify CSRF token enforcement.

Typical attack path

1. Identify the unauthenticated or weakly protected message deletion endpoint
2. Craft a cross-site request that triggers deletion for a target user
3. Host the malicious request on an attacker-controlled page
4. Lure an authenticated victim to visit the attacker page
5. Trigger deletion of messages including those belonging to administrators

How to detect it

Inspect web server and application logs for message deletion requests originating from unexpected referrers or lacking proper token validation indicators.

What your security team should do

• Immediately upgrade all Ampache instances to the fixed version
• Monitor for any unexpected message deletions in application logs
• Review and enforce CSRF protections on all state-changing endpoints