GHSA-q3x9-qgv6-hgq3: AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints
AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST /api/station/{stationid}/waveform/{mediaid} routes, which lack Permissions middleware. Any authenticated user without station assignment can read another station's cached waveform JSON and overwrite it with attacker-supplied data, corrupting Visual Cue Editor data.
Event History
Frequently Asked Questions
Who can exploit the affected endpoints?
Any authenticated AzuraCast user can exploit them, including a user who has no assignment to the targeted station. No user interaction is required.
What can an attacker access or change?
An attacker can read cached waveform JSON for another station and overwrite it with attacker-supplied waveform data. The resulting impact is corruption of Visual Cue Editor data.
Which installations are affected?
AzuraCast versions before 0.24.0 are affected. The issue is present because the GET and POST station waveform routes lack Permissions middleware.