GHSA-c45c-wrcp-22fx: AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()
AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereotoolconfigurationpath or stereotoollicensekey, which are executed via /bin/sh on station restart, compromising the container.
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
A station user with the Profile permission can exploit it. The attacker needs access to the affected station’s StereoTool settings.
What attacker-controlled values are used for command injection?
Shell metacharacters can be injected through the stereo_tool_configuration_path or stereo_tool_license_key settings. The values are executed through /bin/sh when the station restarts.
When does the injected command run, and what is affected?
Execution occurs on station restart rather than necessarily when the setting is saved. Successful exploitation compromises the container.