PT-2024-36804 · Navidrome+2 · Navidrome+2
Saisathvik1
·
Published
2024-12-23
·
Updated
2025-01-10
·
CVE-2024-56362
CVSS v3.1
7.1
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Navidrome versions prior to 0.54.1
Description
Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. The JWT secret is critical for the authentication and authorization system. If exposed, an attacker could forge valid tokens to impersonate users, including administrative accounts, and gain unauthorized access to sensitive data or perform privileged actions.
Recommendations
For versions prior to 0.54.1, update to version 0.54.1 to fix the vulnerability. As a temporary workaround, consider restricting access to the navidrome.db database file to minimize the risk of exploitation. Avoid storing sensitive data in plaintext and ensure the database file is adequately secured.
Exploit
Fix
Cleartext Storage of Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Navidrome
Suse