GHSA-cqgx-rqjr-5gf4: AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist
AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay displayname values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and TitleN= lines into the public playlist.pls to redirect guest listeners to attacker-controlled streams under the victim station's name.
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privilege station user who has either the Station:MountPoints or Station:RemoteRelays permission can exploit it. The attacker must be able to set a mount point or remote relay display_name value containing CR/LF sequences.
What is the practical impact on listeners?
An attacker can add FileN= and TitleN= entries to the public playlist.pls file. This can direct guest listeners to attacker-controlled streams while presenting them under the victim station's name.
Which versions are affected?
AzuraCast versions before 0.24.0 are affected. Upgrading to 0.24.0 or later addresses the affected version range described here.