ALT-PU-2024-17848

CVE-2024-56362

Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. This vulnerability is fixed in 0.54.1.

CVE-2024-47062

Navidrome is an open source web-based music collection server and streamer. Navidrome automatically adds parameters in the URL to SQL queries. This can be exploited to access information by adding parameters like `password=...` in the URL (ORM Leak). Furthermore, the names of the parameters are not properly escaped, leading to SQL Injections. Finally, the username is used in a `LIKE` statement, allowing people to log in with `%` instead of their username. When adding parameters to the URL, they are automatically included in an SQL `LIKE` statement (depending on the parameter's name). This allows attackers to potentially retrieve arbitrary information. For example, attackers can use the following request to test whether some encrypted passwords start with `AAA`. This results in an SQL query like `password LIKE 'AAA%'`, allowing attackers to slowly brute-force passwords. When adding parameters to the URL, they are automatically added to an SQL query. The names of the parameters are not p

GHSA-xwx7-p63r-2rj8

Navidrome Stores JWT Secret in Plaintext in navidrome.db

GHSA-58vj-cv5w-v4v6

Navidrome has Multiple SQL Injections and ORM Leak

BDU:2024-08268

Уязвимость медиасервера Navidrome, связанная с непринятием мер по защите структуры запроса SQL, позволяющая нарушителю выполнить произвольный код и раскрыть защищаемую информацию