CVE-2024-47062

CRITICALNuclei

Multiple SQL Injections and ORM Leak in navidrome

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-47062 has a selected CVSS score of 9.4 (critical); EIP currently links 1 repository PoC, 1 Nuclei template, and 1 lab environment.

Description

Navidrome is an open source web-based music collection server and streamer. Navidrome automatically adds parameters in the URL to SQL queries. This can be exploited to access information by adding parameters like `password=...` in the URL (ORM Leak). Furthermore, the names of the parameters are not properly escaped, leading to SQL Injections. Finally, the username is used in a `LIKE` statement, allowing people to log in with `%` instead of their username. When adding parameters to the URL, they are automatically included in an SQL `LIKE` statement (depending on the parameter's name). This allows attackers to potentially retrieve arbitrary information. For example, attackers can use the following request to test whether some encrypted passwords start with `AAA`. This results in an SQL query like `password LIKE 'AAA%'`, allowing attackers to slowly brute-force passwords. When adding parameters to the URL, they are automatically added to an SQL query. The names of the parameters are not properly escaped. This behavior can be used to inject arbitrary SQL code (SQL Injection). These vulnerabilities can be used to leak information and dump the contents of the database and have been addressed in release version 0.53.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1
Lab environments
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 20, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

navidrome

Browse navidrome / navidrome

Default status: unknown

CVE List0.53.0affected
< 0.53.0affected

github.com/navidrome/navidrome

Browse Go / github.com/navidrome/navidrome
GitHub AdvisoryBefore 0.53.0 · Fixed in 0.53.0affected

Proofs of concept

1

Repository PoCs

GitHubsaisathvik1/CVE-2024-47062Repository PoCby saisathvik10Not analyzed6 files

449.3 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

docker-compose.yml

saisathvik1/CVE-2024-47062Created Vuln labCVE-2024-47062Compose · images

1 Compose manifest · 1 service

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment running Navidrome 0.52.5, accompanied by Python scripts that exploit CVE-2024-47062 via SQL injection to extract user credentials and forge JWT tokens.

docker-compose.yml:1-11README.md:1-3exploit.py:1-108

Lab assessment

Vulnerability lab

The README explicitly states 'CVE-2024-47062 POC', and the included scripts demonstrate SQL injection and JWT forgery against the Navidrome service defined in the Compose file.

README.md:1exploit.py:1-108
Lab shapeCompose · images
Services1
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

navidrome

vulnerable target

Navidrome 0.52.5 music server, exposed on host port 4533, with bind-mounted music and data directories.

docker-compose.yml:4-10

exploit.py

SQL injection exploit

Authenticates to Navidrome, then performs UNION-based SQL injection on the /api/radio endpoint to dump user and property tables, and decrypts extracted passwords.

exploit.py:1-108

decryptor.py

password decryption utility

Decrypts base64-encoded AES-GCM ciphertext using a hardcoded key, used by exploit.py to reveal plaintext passwords.

decryptor.py:1-33

create_jwt.py

JWT forgery tool

Creates a forged JWT using a secret extracted from the property table, enabling privilege escalation.

create_jwt.py:1-16
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2024-47062

Supported by supplied evidence

The exploit.py script demonstrates SQL injection against Navidrome 0.52.5, consistent with the CVE description, and the README explicitly labels the repository as a POC for this CVE.

README.md:1exploit.py:20-28
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the Navidrome service.docker-compose.yml:1-11
  • Valid Navidrome credentials are required to authenticate and trigger the SQL injection.exploit.py:72-74
  • Python 3 with requests, urllib, and cryptography libraries must be available to run the exploit scripts.exploit.py:1-4decryptor.py:4-5

Evidence-described exercise path

  1. Start the vulnerable Navidrome instance using docker-compose up.docker-compose.yml:1-11
  2. Run exploit.py with the base URL and valid credentials to dump user and property tables via SQL injection.exploit.py:72-108
  3. Use the extracted JWT secret from the property table with create_jwt.py to forge an admin token.create_jwt.py:3-15
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All scripts target the local Navidrome container via the documented port mapping. No evidence of host escape, external connectivity, persistence, credential exfiltration, or destructive actions beyond the intended lab target.

exploit.py:1-108docker-compose.yml:1-11
Review boundaries

What the analysis did not establish

  • The navidrome.db binary file is uninspected; its contents are unknown.
  • No Dockerfile is present; the Navidrome image is pulled directly from Docker Hub without inspection.
  • The exercise path assumes the user has valid credentials; no default credentials are provided in the packet.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Nuclei templates

1
ProjectDiscoveryCRITICALNavidrome < 0.53.0 - Authenticated SQL Injection

Navidrome is an open source web-based music collection server and streamer. Navidrome automatically adds parameters in the URL to SQL queries. This can be exploited to access information by adding parameters like `password=...` in the URL (ORM Leak). Furthermore, the names of the parameters are not properly escaped, leading to SQL Injections. Finally, the username is used in a `LIKE` statement, allowing people to log in with `%` instead of their username. When adding parameters to the URL, they are automatically included in an SQL `LIKE` statement (depending on the parameter's name). This allows attackers to potentially retrieve arbitrary information. For example, attackers can use the following request to test whether some encrypted passwords start with `AAA`. This results in an SQL query like `password LIKE 'AAA%'`, allowing attackers to slowly brute-force passwords. When adding parameters to the URL, they are automatically added to an SQL query. The names of the parameters are not properly escaped. This behavior can be used to inject arbitrary SQL code (SQL Injection). These vulnerabilities can be used to leak information and dump the contents of the database and have been addressed in release version 0.53.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact

Authenticated attackers can exploit SQL injection to extract sensitive database information including encrypted passwords.

Remediation

Update Navidrome to version 0.53.0 or later.

Authorsiamnoooob, rootxharsh, pdresearch
Template tagscvecve2024sqliorm-leaknavidromeauthenticatedvuln
Shodan: html:"content="Navidrome""
https://github.com/advisories/GHSA-58vj-cv5w-v4v6 https://github.com/navidrome/navidrome/security/advisories/GHSA-58vj-cv5w-v4v6 https://nvd.nist.gov/vuln/detail/CVE-2024-47062

Source: ProjectDiscovery

References

4