SSRF Vulnerability in AzuraCast Before 0.24.0

Executive Summary

AzuraCast before version 0.24.0 has a server-side request forgery (SSRF) vulnerability. Station users with the WebHooks permission can exploit this by setting internal addresses in instance_url, api, or webhookurl parameters. This allows them to bypass security controls and trigger webhook tests to access loopback, private networks, or cloud metadata services.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor webhook test endpoint requests to internal addresses. Check AzuraCast logs for suspicious connections to loopback, private-network, or cloud-metadata services. Look for requests with instance_url, api, or webhookurl parameters set to internal IPs or domains.

Useful 0 Not Useful 0

Impact Analysis

An attacker with WebHooks permission could access internal systems, exfiltrate data, or interact with services not intended to be publicly reachable. This may lead to unauthorized information disclosure, network reconnaissance, or further attacks on internal infrastructure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to sensitive data or systems. GDPR may be impacted if personal data is exposed, while HIPAA could be breached if protected health information is accessible. Organizations must address this to maintain regulatory compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update AzuraCast to version 0.24.0 or later. Review and restrict WebHooks permissions for station users. Implement network-level controls to block outbound requests to internal addresses from the AzuraCast server. Audit existing webhook configurations for unauthorized internal URLs.

Useful 0 Not Useful 0