The vulnerability in AzuraCast before version 0.23.8 exists in the AutoDJ remote playlist fetch feature, specifically in the QueueBuilder.php's getMediaFromRemoteUrl() function. A user with station Media permission can create or update a playlist with a remote_url parameter that points to local file paths or internal HTTP endpoints. The backend uses PHP's file_get_contents() without scheme allowlisting or IP address restrictions, allowing SSRF and local file read attacks. The fetched content is parsed and exposed via the API endpoint GET /api/station/{station_id}/queue to users with Broadcasting permission, leading to disclosure of sensitive host files and internal HTTP responses. No patch was available at the time of the report.

An attacker with Media permission can exploit this vulnerability to read arbitrary local files on the server or internal HTTP endpoints, potentially exposing sensitive information such as system files or application secrets. The disclosed data is accessible to users with Broadcasting permission via the station queue API. This can lead to information disclosure but does not directly affect integrity or availability.

No official patch or fix was available at the time of publication. Users should restrict Media and Broadcasting permissions to trusted users only and consider disabling PHP allow_url_fopen if possible. Monitor vendor advisories for updates and apply patches when they become available.