AzuraCast Shoutcast Config Injection via Profile Edit

Executive Summary

AzuraCast through 0.23.8 has an issue where frontend_config.custom_config is not removed during a PUT request to /station/{id}/profile/edit for users without Manage station broadcasting permission. The stored JSON is written directly as key=value lines into the Shoutcast sc_serv.conf file. An authenticated user with only Manage station profile permission can override sensitive settings like adminpassword, password, and portbase, or inject arbitrary directives using newlines in keys, potentially hijacking the station's Shoutcast frontend.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with limited permissions to take control of a radio station's Shoutcast server. They could change admin credentials, alter broadcast settings, or inject malicious configurations, disrupting broadcasts or taking over the station entirely.

Useful 0 Not Useful 0

Mitigation Strategies

Update AzuraCast to a version that fixes the issue where frontend_config.custom_config is not properly sanitized for users without Manage station broadcasting permission. Ensure only authorized users have the Manage station profile permission.

Useful 0 Not Useful 0