Command Injection in AzuraCast via Liquidsoap Config

Executive Summary

This is a command injection vulnerability in AzuraCast versions through 0.23.x. It occurs during live recording when Liquidsoap config generation fails to properly quote the streamer username in process.run calls. Authenticated users with Streamers and Profile permissions can exploit this by setting a username containing shell metacharacters, which executes arbitrary commands as the Liquidsoap process user when recording stops.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check AzuraCast logs for unusual commands executed by the Liquidsoap process. Look for process.run calls with unquoted streamer usernames containing shell metacharacters. Review user accounts with Streamers and Profile permissions for suspicious usernames.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain control over the Liquidsoap process user account, potentially leading to unauthorized command execution on the server. This could allow data theft, system compromise, or disruption of AzuraCast services. The impact is limited to users with Streamers and Profile permissions who can set malicious usernames.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's security rules for protected health information. Organizations using affected AzuraCast versions may face compliance violations if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update AzuraCast to the latest version. If updating is not possible, restrict streamer usernames to alphanumeric characters only. Disable live recording if not needed. Monitor for unauthorized command execution by the Liquidsoap process user.

Useful 0 Not Useful 0