CVE-2024-32963: 
NixOS vulnerability analysis and mitigation

CVE-2024-32963 is a parameter tampering vulnerability discovered in Navidrome, an open source web-based music collection server and streamer. The vulnerability was disclosed on May 1, 2024, affecting versions prior to 0.52.0. The vulnerability allows an attacker to manipulate parameter values in HTTP requests, potentially leading to user impersonation (GitHub Advisory, NVD).

The vulnerability stems from improper parameter validation in HTTP requests, where an attacker can manipulate parameter values in the request body to impersonate other users. The vulnerability has been assigned a CVSS v3.1 base score of 4.2 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (NVD).

The vulnerability impacts all known users of the affected Navidrome versions. An attacker can obtain the ownerId from shared playlist information, allowing them to impersonate any user who has shared a playlist. The attacker can create playlists, add songs, post comments, set playlists to public, and attribute ownership to other users, including administrators (GitHub Advisory).

The vulnerability requires the attacker to be able to intercept HTTP traffic and have the ability to manipulate parameter values in HTTP requests. The attacker must also have access to a valid user account and be able to obtain the ownerId of the target user through shared playlist information (GitHub Advisory).

The vulnerability has been patched in Navidrome version 0.52.0. Users are strongly advised to upgrade to this version or later. There are no known workarounds for this vulnerability (NVD).