Vulnerability · Published May 1, 2024 · Assigned by GitHub_M
CVE-2024-32963Parameter Tampering vulnerability in Navidrome
Medium 4.2
In plain English
A medium-severity information exposure in navidrome from navidrome. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Navidrome is an open source web-based music collection server and streamer. In affected versions of Navidrome are subject to a parameter tampering vulnerability where an attacker has the ability to manipulate parameter values in the HTTP requests. The attacker is able to change the parameter values in the body and successfully impersonate another user. In this case, the attacker created a playlist, added song, posted arbitrary comment, set the playlist to be public, and put the admin as the owner of the playlist. The attacker must be able to intercept http traffic for this attack. Each known user is impacted. An attacker can obtain the ownerId from shared playlist information, meaning every user who has shared a playlist is also impacted, as they can be impersonated. This issue has been addressed in version 0.52.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/navidrome/navidrome | 0.52.0 | GHSA-4jrx-5w4h-3gpm |
| Go | github.com/navidrome/navidrome | 0.52.0 | GO-2024-2803 |
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
References
- https://github.com/navidrome/navidrome/security/advisories/GHSA-4jrx-5w4h-3gpm x_refsource_CONFIRM