{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-51442"
      ],
      "details": "Navidrome is an open source web-based music collection server and streamer. A security vulnerability has been identified in navidrome\u0027s subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by utilizing a JSON Web Token (JWT) signed with the key \"not so secret\". The vulnerability can only be exploited on instances that have never been restarted. Navidrome supports an extension to the subsonic authentication scheme, where a JWT can be provided using a `jwt` query parameter instead of the traditional password or token and salt (corresponding to resp. the `p` or `t` and `s` query parameters). This authentication bypass vulnerability potentially affects all instances that don\u0027t protect the subsonic endpoint `/rest/`, which is expected to be most instances in a standard deployment, and most instances in the reverse proxy setup too (as the documentation mentions to leave that endpoint unprotected). This issue has been patched in version 0.50.2.\n",
      "id": "GSD-2023-51442",
      "modified": "2023-12-21T06:01:31.551436Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2023-51442",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "navidrome",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "\u003c= 0.50.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "navidrome"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Navidrome is an open source web-based music collection server and streamer. A security vulnerability has been identified in navidrome\u0027s subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by utilizing a JSON Web Token (JWT) signed with the key \"not so secret\". The vulnerability can only be exploited on instances that have never been restarted. Navidrome supports an extension to the subsonic authentication scheme, where a JWT can be provided using a `jwt` query parameter instead of the traditional password or token and salt (corresponding to resp. the `p` or `t` and `s` query parameters). This authentication bypass vulnerability potentially affects all instances that don\u0027t protect the subsonic endpoint `/rest/`, which is expected to be most instances in a standard deployment, and most instances in the reverse proxy setup too (as the documentation mentions to leave that endpoint unprotected). This issue has been patched in version 0.50.2.\n"
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-287",
                "lang": "eng",
                "value": "CWE-287: Improper Authentication"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/navidrome/navidrome/security/advisories/GHSA-wq59-4q6r-635r",
            "refsource": "MISC",
            "url": "https://github.com/navidrome/navidrome/security/advisories/GHSA-wq59-4q6r-635r"
          },
          {
            "name": "https://github.com/navidrome/navidrome/commit/1132abb0135d1ecaebc41ed97a1e908a4ae02f7c",
            "refsource": "MISC",
            "url": "https://github.com/navidrome/navidrome/commit/1132abb0135d1ecaebc41ed97a1e908a4ae02f7c"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-wq59-4q6r-635r",
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:navidrome:navidrome:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "230BD176-20CA-4E61-BD08-AB11F8ACBF0B",
                    "versionEndExcluding": "0.50.2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "Navidrome is an open source web-based music collection server and streamer. A security vulnerability has been identified in navidrome\u0027s subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by utilizing a JSON Web Token (JWT) signed with the key \"not so secret\". The vulnerability can only be exploited on instances that have never been restarted. Navidrome supports an extension to the subsonic authentication scheme, where a JWT can be provided using a `jwt` query parameter instead of the traditional password or token and salt (corresponding to resp. the `p` or `t` and `s` query parameters). This authentication bypass vulnerability potentially affects all instances that don\u0027t protect the subsonic endpoint `/rest/`, which is expected to be most instances in a standard deployment, and most instances in the reverse proxy setup too (as the documentation mentions to leave that endpoint unprotected). This issue has been patched in version 0.50.2.\n"
          },
          {
            "lang": "es",
            "value": "Navidrome es un servidor y transmisor de colecci\u00f3n de m\u00fasica basado en web de c\u00f3digo abierto. Se ha identificado una vulnerabilidad de seguridad en el endpoint subs\u00f3nico de Navidrome, lo que permite omitir la autenticaci\u00f3n. Esta explotaci\u00f3n permite el acceso no autorizado a cualquier cuenta conocida mediante la utilizaci\u00f3n de un token web JSON (JWT) firmado con la clave \"not so secret\". La vulnerabilidad s\u00f3lo se puede explotar en instancias que nunca se han reiniciado. Navidrome admite una extensi\u00f3n del esquema de autenticaci\u00f3n subs\u00f3nica, donde se puede proporcionar un JWT usando un par\u00e1metro de consulta `jwt` en lugar de la contrase\u00f1a tradicional o token y salt (correspondiente a, respectivamente, la consulta `p` o `t` y `s` par\u00e1metros). Esta vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n afecta potencialmente a todas las instancias que no protegen el endpoint subs\u00f3nico `/rest/`, que se espera que sea la mayor\u00eda de las instancias en una implementaci\u00f3n est\u00e1ndar, y tambi\u00e9n la mayor\u00eda de las instancias en la configuraci\u00f3n de proxy inverso (como menciona la documentaci\u00f3n para dejar ese punto final desprotegido). Este problema se solucion\u00f3 en la versi\u00f3n 0.50.2."
          }
        ],
        "id": "CVE-2023-51442",
        "lastModified": "2024-01-04T14:12:46.563",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.6,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.6,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2023-12-21T15:15:13.397",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/navidrome/navidrome/commit/1132abb0135d1ecaebc41ed97a1e908a4ae02f7c"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/navidrome/navidrome/security/advisories/GHSA-wq59-4q6r-635r"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-287"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.50.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/navidrome/navidrome"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.50.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-51442"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-19T23:37:45Z",
    "nvd_published_at": "2023-12-21T15:15:13Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nA security vulnerability has been identified in navidrome\u0027s subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by utilizing a JSON Web Token (JWT) signed with the key \"not so secret\".\n\nThe vulnerability can only be exploited on instances that have never been restarted.\n\n### Details\n\nNavidrome supports an extension to the subsonic authentication scheme, where a JWT can be provided using a `jwt` query parameter instead of the traditional password or token and salt (corresponding to resp. the `p` or `t` and `s` query parameters).\n\nDuring the first initialization, navidrome generates a random key that is then used by the authentication module to validate JWTs before extracting the username from the `sub` claim. If for some reason the key cannot be retrieved by the initialization code, a hardcoded value is used instead: \"not so secret\".\n\nA bug in the order of operations during navidrome startup results in the authentication module initializing before the module responsible for generating and persisting the random key. As a consequence, the authentication module falls back to using the hardcoded value, which remains in use until the instance gets restarted. Additionally, an error that was meant to be logged when the fallback value is used does not get logged due to another bug, preventing the operator from becoming aware of the issue.\n\nThe flaw allows the creation of a JWT with the `sub` claim set to any existing user on the server, signed with the key \"not so secret\", which can then be used to authenticate against the subsonic endpoint with the chosen user\u0027s privileges.\n\nAfter navidrome is restarted, the random key generated during the previous startup is loaded and the flaw becomes inexploitable.\n\n### PoC\n\nGenerate a JWT token with the subject \"admin\", and key \"not so secret\" (e.g. online on: http://jwtbuilder.jamiekurtz.com; the other parameters can be left in, it doesn\u0027t seem that navidrome validates anything). In a shell, assign the token to the variable `JWT` (for the curl commands below).\n\n```\n$ podman run -d --name navidrome -p 127.0.0.1:4533:4533 -e ND_DEVAUTOCREATEADMINPASSWORD=password docker.io/deluan/navidrome:0.50.1\n$ curl \"http://localhost:4533/rest/ping.view?c=dummy\u0026v=1\u0026u=admin\u0026jwt=$JWT\"\n\u003csubsonic-response xmlns=\"http://subsonic.org/restapi\" status=\"ok\" version=\"1.16.1\" type=\"navidrome\" serverVersion=\"0.50.1 (f69c27d1)\" openSubsonic=\"true\"\u003e\u003c/subsonic-response\u003e\n```\n\nThe `ND_DEVAUTOCREATEADMINPASSWORD` parameter does not influence the bypass, it also works if the admin or extra users are created manually after starting navidrome.\n\nRestarting navidrome prevents the bypass:\n\n```\n$ podman restart navidrome\n$ curl \"http://localhost:4533/rest/ping.view?c=dummy\u0026v=1\u0026u=admin\u0026jwt=$JWT\"\n\u003csubsonic-response xmlns=\"http://subsonic.org/restapi\" status=\"failed\" version=\"1.16.1\" type=\"navidrome\" serverVersion=\"0.50.1 (f69c27d1)\" openSubsonic=\"true\"\u003e\u003cerror code=\"40\" message=\"Wrong username or password\"\u003e\u003c/error\u003e\u003c/subsonic-response\u003e\n```\n\n### Impact\n\nThis authentication bypass vulnerability potentially affects all instances that don\u0027t protect the subsonic endpoint `/rest/`, which is expected to be most instances in a standard deployment, and most instances in the reverse proxy setup too (as the documentation mentions to leave that endpoint unprotected).\n\nThe impact is limited by the fact that the flaw becomes inexploitable after a first restart, and the attacker needs to know the username of existing users on the instance.\n\nFor each known user, the attacker could mess with (create/delete/change) playlists, bookmarks, media annotations, shares (which are currently global) and radios. He is also able to get the user\u0027s email address (which is PII) with the `getUser` operation. And lastly he can use the media retrieval operations which could potentially affect the availability of the system.",
  "id": "GHSA-wq59-4q6r-635r",
  "modified": "2023-12-21T15:58:09Z",
  "published": "2023-12-19T23:37:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/navidrome/navidrome/security/advisories/GHSA-wq59-4q6r-635r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51442"
    },
    {
      "type": "WEB",
      "url": "https://github.com/navidrome/navidrome/commit/1132abb0135d1ecaebc41ed97a1e908a4ae02f7c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/navidrome/navidrome"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Authentication bypass vulnerability in navidrome\u0027s subsonic endpoint"
}