Threats affecting pkg:composer/azuracast/azuracast

AzuraCast versions before 0.23.8 have a vulnerability where the 'Remote Relay' URL is only validated for syntax and scheme, without host or IP restrictions. This allows users with station-scoped RemoteRelays permission to set URLs pointing to internal or sensitive addresses, causing the server to make repeated HTTP requests to these addresses. This results in server-side request forgery (SSRF). No patch is currently available for this issue.

AzuraCast versions prior to 0.23.6 contain a vulnerability in the sanitization of the remote relay password field in Liquidsoap configuration. The method cleanUpString() intended to strip Liquidsoap interpolation patterns can be bypassed using nested interpolation syntax, allowing an attacker with RemoteRelays station permission to inject arbitrary Liquidsoap code. This can lead to arbitrary code execution within the Liquidsoap process, disclosure of internal API keys, and disruption of station operation. The vulnerability arises because the password field was not migrated to the safer toRawString() method, which prevents interpolation. A patch is available in version 0.23.6 that fixes this issue.

AzuraCast versions prior to 0.23.6 have a missing permissions check on the media file download endpoint GET /api/station/{station_id}/file/{id}/play. This flaw allows any authenticated user to download media files from any station, regardless of their permissions, enabling cross-station media exfiltration in multi-tenant deployments. The vulnerability arises because the /play route lacks the Permissions middleware that protects other file-related endpoints. Media IDs are auto-incremented, making enumeration and unauthorized access trivial. A fix is available in version 0.23.6.

AzuraCast versions prior to 0.23.6 have a vulnerability in the Liquidsoap API endpoint due to missing internal connection middleware and improper API key validation. This allows any user with the lowest station-level permission (View) to invoke privileged commands, inject arbitrary now-playing metadata, disrupt live broadcasts, and disclose absolute filesystem paths. The flaw arises because the endpoint is accessible publicly without the RequireInternalConnection middleware, and the $asAutoDj flag is set based on the presence of the X-Liquidsoap-Api-Key header rather than its validated value. A fix is available in version 0.23.6.