CVE-2024-51490

What it actually does

Improper sanitization of the Custom URL - Logo field in the interface settings allows injection and execution of arbitrary JavaScript in the context of other users' browsers.

Why it matters to the business

Compromised user sessions, unauthorized actions on the media library, or site defacement could disrupt streaming services and expose internal content or credentials.

How an attack unfolds

An authenticated attacker navigates to the interface settings, submits a JavaScript payload in the Custom URL - Logo field, and the unsanitized value is rendered when any user loads the menu, executing the script in the victim's browser session.

How to fix it

Upgrade Ampache to version 7.0.1 or apply commit 312765c0cc5e12a4208b70d2739a021be144230d; no workarounds exist.

How to confirm the fix worked

Confirm the installed version is 7.0.1 or later; attempt to save a test script tag in the Custom URL - Logo field and verify it is escaped or rejected on subsequent page loads.

Typical attack path

1. Obtain valid user credentials with access to settings
2. Navigate to the interface section of the menu
3. Enter malicious JavaScript into the Custom URL - Logo field
4. Save the configuration
5. Induce or wait for a privileged user to view the affected page
6. Perform actions via the victim's authenticated session

How to detect it

Review web server access logs and application logs around settings update endpoints for anomalous input containing script tags or javascript: URIs; inspect database records storing custom logo URLs for executable content.

What your security team should do

• Immediately upgrade all Ampache instances to the fixed commit or 7.0.1
• Audit existing Custom URL - Logo values for unexpected script content
• Restrict settings access to the minimum necessary accounts until patched