GHSA-5x35-83gj-w8gw: AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export
AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/{stationid}/files/bulk so formulas evaluate when other users open exported CSVs in spreadsheets.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AzuraCastto a version that resolves this vulnerability.Fixed in 0.24.0
Event History
Frequently Asked Questions
Which installations are affected?
AzuraCast installations running a version before 0.24.0 are affected.
What access does an attacker need?
The attacker needs a station user account with Media permission. They can use the bulk media import endpoint to store crafted values in titles, artists, or custom fields.
When does the malicious content execute?
The injected spreadsheet formula is evaluated when another user opens an exported CSV in a spreadsheet application. The attacker must first persist formula-prefixed metadata through bulk media import.