Stored XSS in Ampache Media Server via Lyrics Injection

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Ampache versions before 8.4.0. It allows users with upload rights to inject malicious scripts via song lyrics in ID3 tags. The lyrics are not properly escaped when displayed in LyricsView.php and show_lyrics.inc.php, enabling attackers to execute arbitrary code in the browsers of users viewing the lyrics.

Useful 0 Not Useful 0

Detection Guidance

Check Ampache version with: grep -r 'version' /path/to/ampache/config. If version is below 8.4.0, the system is vulnerable. Inspect LyricsView.php for unescaped lyrics output. Look for user-uploaded songs with ID3 tags containing HTML or script content.

Useful 0 Not Useful 0

Impact Analysis

An attacker could upload a malicious song file with script-containing lyrics. When other users view these lyrics, the injected script executes in their browsers, potentially stealing session cookies, redirecting to phishing sites, or performing actions on their behalf. This requires the attacker to have upload privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in data breaches, unauthorized disclosure, or modification of sensitive data, potentially leading to regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Ampache to version 8.4.0 or later immediately. Review and remove any malicious song files with HTML/JS in lyrics. Ensure all user inputs in metadata are properly escaped. Monitor for unusual activity in user-uploaded content.

Useful 0 Not Useful 0