CVE-2024-56362: 
NixOS vulnerability analysis and mitigation

Navidrome, an open source web-based music collection server and streamer, was found to store JWT secrets in plaintext within the navidrome.db database file under the property table. The vulnerability, identified as CVE-2024-56362, was disclosed on December 23, 2024, and affects versions up to and including 0.53.3. This security issue has been resolved in version 0.54.1 (GitHub Advisory).

The vulnerability is classified as CWE-312 (Cleartext Storage of Sensitive Information) with a CVSS v3.1 score of 7.1 (High). The attack vector is local (AV:L), with low attack complexity (AC:L), requiring low privileges (PR:L), and no user interaction (UI:N). The scope is unchanged (S:U), with high impact on confidentiality (C:H) and integrity (I:H), but no impact on availability (A:N) (GitHub Advisory).

The exposure of the JWT secret could allow attackers with access to the database file to forge valid tokens to impersonate users, including administrative accounts, and gain unauthorized access to sensitive data or perform privileged actions. This poses a significant risk in environments where the database file is not adequately secured (GitHub Advisory).

The vulnerability has been fixed in Navidrome version 0.54.1. The fix includes implementing encryption for the JWT secret at rest, preventing the storage of the secret in plaintext. Users are advised to upgrade to version 0.54.1 or later to address this security issue (GitHub Commit).