GHSA-qh22-76gf-qwc4: AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors
AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass the UserUrlFilter guard via the Mastodon, Telegram, GroupMe, and RadioReg connectors. Attackers can set instanceurl, api, or webhookurl to internal addresses and trigger the webhook test endpoint to reach loopback, private-network, or cloud-metadata services.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs access as a station user with the WebHooks permission. No separate privileged administrator role is identified as necessary.
Which webhook connectors are affected?
The affected connectors are Mastodon, Telegram, GroupMe, and RadioReg. Their instance_url, api, or webhookurl settings can be pointed at internal targets.
What internal services could be reached?
The webhook test endpoint can be used to send requests to loopback addresses, private-network services, and cloud metadata services.
Are installations affected by default?
The issue requires a station user to have WebHooks permission and to configure one of the affected connectors. The provided information does not establish whether that permission or any affected connector is enabled by default.
What version addresses the issue?
AzuraCast versions before 0.24.0 are affected. Updating to 0.24.0 or later addresses the affected version range described here.