GHSA-2wcv-vv3g-g86q: AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config
AzuraCast through 0.23.8 fails to remove frontendconfig.customconfig in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast scserv.conf file. An authenticated user with only the Manage station profile permission can override adminpassword, password, and portbase, or inject arbitrary directives via newlines in keys, hijacking the station's Shoutcast frontend.
Event History
Frequently Asked Questions
Which accounts can exploit this issue?
An authenticated user who has the Manage station profile permission can exploit it even if they do not have the Manage station broadcasting permission. No administrator privileges or user interaction are required.
What does an attacker need to do to take over the Shoutcast frontend?
The attacker must submit a PUT request to /station/{id}/profile/edit containing frontend_config.custom_config. They can override adminpassword, password, or portbase, or use newline characters in keys to inject arbitrary Shoutcast sc_serv.conf directives.
How can I determine whether a station may already be affected?
Inspect the station profile configuration and the generated Shoutcast sc_serv.conf file for unexpected custom configuration entries, changed adminpassword, password, or portbase values, and directives that do not match the intended station configuration.