CVE-2024-47062

Vulnerability from cvelistv5

Published

2024-09-20 19:01

Modified

2024-09-20 19:17

Severity ?

9.4 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L

Summary

Navidrome is an open source web-based music collection server and streamer. Navidrome automatically adds parameters in the URL to SQL queries. This can be exploited to access information by adding parameters like `password=...` in the URL (ORM Leak). Furthermore, the names of the parameters are not properly escaped, leading to SQL Injections. Finally, the username is used in a `LIKE` statement, allowing people to log in with `%` instead of their username. When adding parameters to the URL, they are automatically included in an SQL `LIKE` statement (depending on the parameter's name). This allows attackers to potentially retrieve arbitrary information. For example, attackers can use the following request to test whether some encrypted passwords start with `AAA`. This results in an SQL query like `password LIKE 'AAA%'`, allowing attackers to slowly brute-force passwords. When adding parameters to the URL, they are automatically added to an SQL query. The names of the parameters are not properly escaped. This behavior can be used to inject arbitrary SQL code (SQL Injection). These vulnerabilities can be used to leak information and dump the contents of the database and have been addressed in release version 0.53.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References

▼	URL	Tags
	security-advisories@github.com	https://github.com/navidrome/navidrome/security/advisories/GHSA-58vj-cv5w-v4v6

Impacted products

Vendor

Product

Version

▼

navidrome

Version: < 0.53.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:navidrome:navidrome:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "navidrome",
            "vendor": "navidrome",
            "versions": [
              {
                "status": "affected",
                "version": "0.53.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47062",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-20T19:16:46.543650Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-20T19:17:55.852Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "navidrome",
          "vendor": "navidrome",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.53.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Navidrome is an open source web-based music collection server and streamer. Navidrome automatically adds parameters in the URL to SQL queries. This can be exploited to access information by adding parameters like `password=...` in the URL (ORM Leak). Furthermore, the names of the parameters are not properly escaped, leading to SQL Injections. Finally, the username is used in a `LIKE` statement, allowing people to log in with `%` instead of their username. When adding parameters to the URL, they are automatically included in an SQL `LIKE` statement (depending on the parameter\u0027s name). This allows attackers to potentially retrieve arbitrary information. For example, attackers can use the following request to test whether some encrypted passwords start with `AAA`. This results in an SQL query like `password LIKE \u0027AAA%\u0027`, allowing attackers to slowly brute-force passwords. When adding parameters to the URL, they are automatically added to an SQL query. The names of the parameters are not properly escaped. This behavior can be used to inject arbitrary SQL code (SQL Injection). These vulnerabilities can be used to leak information and dump the contents of the database and have been addressed in release version 0.53.0. Users are advised to upgrade. There are no known workarounds for this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-20T19:01:09.547Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/navidrome/navidrome/security/advisories/GHSA-58vj-cv5w-v4v6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/navidrome/navidrome/security/advisories/GHSA-58vj-cv5w-v4v6"
        }
      ],
      "source": {
        "advisory": "GHSA-58vj-cv5w-v4v6",
        "discovery": "UNKNOWN"
      },
      "title": "Multiple SQL Injections and ORM Leak in navidrome"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47062",
    "datePublished": "2024-09-20T19:01:09.547Z",
    "dateReserved": "2024-09-17T17:42:37.027Z",
    "dateUpdated": "2024-09-20T19:17:55.852Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47062\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-09-20T19:15:16.760\",\"lastModified\":\"2024-09-26T13:32:55.343\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Navidrome is an open source web-based music collection server and streamer. Navidrome automatically adds parameters in the URL to SQL queries. This can be exploited to access information by adding parameters like `password=...` in the URL (ORM Leak). Furthermore, the names of the parameters are not properly escaped, leading to SQL Injections. Finally, the username is used in a `LIKE` statement, allowing people to log in with `%` instead of their username. When adding parameters to the URL, they are automatically included in an SQL `LIKE` statement (depending on the parameter\u0027s name). This allows attackers to potentially retrieve arbitrary information. For example, attackers can use the following request to test whether some encrypted passwords start with `AAA`. This results in an SQL query like `password LIKE \u0027AAA%\u0027`, allowing attackers to slowly brute-force passwords. When adding parameters to the URL, they are automatically added to an SQL query. The names of the parameters are not properly escaped. This behavior can be used to inject arbitrary SQL code (SQL Injection). These vulnerabilities can be used to leak information and dump the contents of the database and have been addressed in release version 0.53.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.\"},{\"lang\":\"es\",\"value\":\"Navidrome es un servidor y transmisor de m\u00fasica de c\u00f3digo abierto basado en la web. Navidrome agrega autom\u00e1ticamente par\u00e1metros en la URL a las consultas SQL. Esto se puede explotar para acceder a la informaci\u00f3n agregando par\u00e1metros como `password=...` en la URL (filtraci\u00f3n de ORM). Adem\u00e1s, los nombres de los par\u00e1metros no se escapan correctamente, lo que lleva a inyecciones SQL. Finalmente, el nombre de usuario se usa en una declaraci\u00f3n `LIKE`, lo que permite a las personas iniciar sesi\u00f3n con `%` en lugar de su nombre de usuario. Al agregar par\u00e1metros a la URL, se incluyen autom\u00e1ticamente en una declaraci\u00f3n SQL `LIKE` (seg\u00fan el nombre del par\u00e1metro). Esto permite a los atacantes recuperar potencialmente informaci\u00f3n arbitraria. Por ejemplo, los atacantes pueden usar la siguiente solicitud para probar si algunas contrase\u00f1as cifradas comienzan con `AAA`. Esto da como resultado una consulta SQL como `password LIKE \u0027AAA%\u0027`, lo que permite a los atacantes forzar lentamente las contrase\u00f1as. Al agregar par\u00e1metros a la URL, se agregan autom\u00e1ticamente a una consulta SQL. Los nombres de los par\u00e1metros no se escapan correctamente. Este comportamiento se puede utilizar para inyectar c\u00f3digo SQL arbitrario (inyecci\u00f3n SQL). Estas vulnerabilidades se pueden utilizar para filtrar informaci\u00f3n y volcar el contenido de la base de datos y se han solucionado en la versi\u00f3n 0.53.0. Se recomienda a los usuarios que actualicen la versi\u00f3n. No se conocen workarounds para esta vulnerabilidad.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":9.4,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnerableSystemConfidentiality\":\"HIGH\",\"vulnerableSystemIntegrity\":\"HIGH\",\"vulnerableSystemAvailability\":\"HIGH\",\"subsequentSystemConfidentiality\":\"HIGH\",\"subsequentSystemIntegrity\":\"HIGH\",\"subsequentSystemAvailability\":\"LOW\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirements\":\"NOT_DEFINED\",\"integrityRequirements\":\"NOT_DEFINED\",\"availabilityRequirements\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnerableSystemConfidentiality\":\"NOT_DEFINED\",\"modifiedVulnerableSystemIntegrity\":\"NOT_DEFINED\",\"modifiedVulnerableSystemAvailability\":\"NOT_DEFINED\",\"modifiedSubsequentSystemConfidentiality\":\"NOT_DEFINED\",\"modifiedSubsequentSystemIntegrity\":\"NOT_DEFINED\",\"modifiedSubsequentSystemAvailability\":\"NOT_DEFINED\",\"safety\":\"NOT_DEFINED\",\"automatable\":\"NOT_DEFINED\",\"recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-89\"}]}],\"references\":[{\"url\":\"https://github.com/navidrome/navidrome/security/advisories/GHSA-58vj-cv5w-v4v6\",\"source\":\"security-advisories@github.com\"}]}}"
  }
}

ghsa-58vj-cv5w-v4v6

Vulnerability from github

Published

2024-09-20 14:51

Modified

2024-09-20 22:07

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
9.4 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L

Summary

Navidrome has Multiple SQL Injections and ORM Leak

Details

Security Advisory: Multiple Vulnerabilities in Navidrome

Summary

Navidrome automatically adds parameters in the URL to SQL queries. This can be exploited to access information by adding parameters like password=... in the URL (ORM Leak).

Furthermore, the names of the parameters are not properly escaped, leading to SQL Injections.

Finally, the username is used in a LIKE statement, allowing people to log in with % instead of their username.

Details

ORM Leak

When adding parameters to the URL, they are automatically included in an SQL LIKE statement (depending on the parameter's name). This allows attackers to potentially retrieve arbitrary information.

For example, attackers can use the following request to test whether some encrypted passwords start with AAA:

GET /api/user?_end=36&_order=DESC&password=AAA%

This results in an SQL query like password LIKE 'AAA%', allowing attackers to slowly brute-force passwords. (Also, any reason for using encryption instead of hashing?)

SQL Injections

When adding parameters to the URL, they are automatically added to an SQL query. The names of the parameters are not properly escaped.

This behavior can be used to inject arbitrary SQL code (SQL Injection), for example:

GET /api/album?_end=36&_order=DESC&_sort=recently_added&_start=0&SELECT+*+FROM+USER--=123 HTTP/1.1

This is only an example, but you should see an error message in the logs.

Authentication Weakness

When retrieving the user for authentication, the following code is used:

go func (r *userRepository) FindByUsername(username string) (model.User, error) { sel := r.newSelect().Columns("").Where(Like{"user_name": username}) var usr model.User err := r.queryOne(sel, &usr) return &usr, err }

This relies on a LIKE statement and allows users to log in with % instead of the legitimate username.

Proof of Concept (PoC)

See above.

Impact

These vulnerabilities can be used to leak information and dump the contents of the database.

Credit

Louis Nyffenegger from PentesterLab

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/navidrome/navidrome"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.53.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-47062"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-20T14:51:56Z",
    "nvd_published_at": "2024-09-20T19:15:16Z",
    "severity": "CRITICAL"
  },
  "details": "# Security Advisory: Multiple Vulnerabilities in Navidrome\n\n## Summary\n\nNavidrome automatically adds parameters in the URL to SQL queries. This can be exploited to access information by adding parameters like `password=...` in the URL (ORM Leak).\n\nFurthermore, the names of the parameters are not properly escaped, leading to SQL Injections.\n\nFinally, the username is used in a `LIKE` statement, allowing people to log in with `%` instead of their username.\n\n## Details\n\n### ORM Leak\n\nWhen adding parameters to the URL, they are automatically included in an SQL `LIKE` statement (depending on the parameter\u0027s name). This allows attackers to potentially retrieve arbitrary information.\n\nFor example, attackers can use the following request to test whether some encrypted passwords start with `AAA`:\n\n```\nGET /api/user?_end=36\u0026_order=DESC\u0026password=AAA%\n```\n\nThis results in an SQL query like `password LIKE \u0027AAA%\u0027`, allowing attackers to slowly brute-force passwords. (Also, any reason for using encryption instead of hashing?)\n\n### SQL Injections\n\nWhen adding parameters to the URL, they are automatically added to an SQL query. The names of the parameters are not properly escaped.\n\nThis behavior can be used to inject arbitrary SQL code (SQL Injection), for example:\n\n```\nGET /api/album?_end=36\u0026_order=DESC\u0026_sort=recently_added\u0026_start=0\u0026SELECT+*+FROM+USER--=123 HTTP/1.1\n```\n\nThis is only an example, but you should see an error message in the logs.\n\n### Authentication Weakness\n\nWhen retrieving the user for authentication, the following code is used:\n\n```go\nfunc (r *userRepository) FindByUsername(username string) (model.User, error) {\n    sel := r.newSelect().Columns(\"\").Where(Like{\"user_name\": username})\n    var usr model.User\n    err := r.queryOne(sel, \u0026usr)\n    return \u0026usr, err\n}\n```\n\nThis relies on a `LIKE` statement and allows users to log in with `%` instead of the legitimate username.\n\n## Proof of Concept (PoC)\n\nSee above.\n\n## Impact\n\nThese vulnerabilities can be used to leak information and dump the contents of the database.\n\n## Credit\n\nLouis Nyffenegger from PentesterLab",
  "id": "GHSA-58vj-cv5w-v4v6",
  "modified": "2024-09-20T22:07:50Z",
  "published": "2024-09-20T14:51:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/navidrome/navidrome/security/advisories/GHSA-58vj-cv5w-v4v6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47062"
    },
    {
      "type": "WEB",
      "url": "https://github.com/navidrome/navidrome/commit/3107170afd9f557a10f7031f23cb3c9e975a71f9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/navidrome/navidrome"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Navidrome has Multiple SQL Injections and ORM Leak"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2024-47062

Vulnerability from cvelistv5

ghsa-58vj-cv5w-v4v6

Vulnerability from github

Security Advisory: Multiple Vulnerabilities in Navidrome

Summary

Details

ORM Leak

SQL Injections

Authentication Weakness

Proof of Concept (PoC)

Impact

Credit

Tags

Sightings

Nomenclature