GHSA-23wx-88m8-pfm2: AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone
AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program that executes OS commands as root when configuration regenerates.
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated user with station manager privileges can exploit it. The attacker needs access to the station profile edit API and must be able to control the station timezone value.
What conditions trigger command execution?
The attacker submits a timezone value containing newlines that injects a new Supervisor program definition. OS commands execute as root when the Supervisor configuration is regenerated.
How can I check for possible exploitation?
Review station timezone values and profile-edit API activity for timezone inputs containing newline characters or Supervisor configuration content. Also inspect regenerated Supervisor configurations for unexpected program definitions and investigate any commands configured to run as root.