AzuraCast CVE-2025-67737

Exploitable against default AzuraCast 0.23.1 installations where the /api/internal/sftp-event (and sftp-auth) route was mistakenly mounted on the public HTTP API without the internal-connection check. No authentication is required (PR:N), but exploitation is materially LIMITED by two knowledge prerequisites explicitly stated in the advisory: the attacker must know a valid SFTP username tied to the target station, and must know (or brute-force/guess) the internal filesystem path of the target media file. The endpoint returns no data, so paths/usernames cannot be enumerated via its responses - raising attack complexity (AC:H). Impact is confined to integrity of media database records (lost playlist associations and custom metadata); no files are actually deleted, no confidential data is disclosed, and no availability loss occurs. Patched by restricting the endpoint to the internal HTTP service bound to localhost inside the container.

Signals point to a LOW real-world priority despite an alarming advisory title. The GHSA headline claims 'Pre-Auth File Deletion & Admin RCE,' but neither the CVE description, the CVSS vector (C:N/I:L/A:N, score 3.7), nor the demonstrated exploit support RCE or destructive file deletion - the actual impact is limited to tricking AzuraCast into deleting a media *database record* (losing playlist associations and custom metadata), which the system later self-heals when it rediscovers the file. This is a notable discrepancy: treat the 'RCE' framing as sensationalized and weight the CVSS/description instead. CVSS correctly shows AV:N/PR:N (network-reachable, no authentication) but AC:H, because the attacker must know a valid SFTP station username AND the internal filesystem path for target media - a meaningful barrier. EPSS is low (0.25%, 15th percentile) and the CVE is NOT in CISA KEV, consistent with the modest integrity-only impact. Publicly available exploit code exists (the advisory includes a working curl PoC), so weaponization is trivial for anyone who clears the knowledge prerequisites, but there is no public exploit identified as being used in active attacks. Net: a genuine missing-authorization bug worth patching, but not an emergency - low integrity impact, no confidentiality/availability loss, and non-trivial attacker prerequisites.

A remote, unauthenticated attacker who has learned a valid SFTP station username and the internal media path (e.g. /var/azuracast/stations/test/media/test.mp3) sends a crafted POST to the exposed /api/internal/sftp-event endpoint with action 'pre-delete', impersonating the internal sftpgo service. AzuraCast deletes the corresponding media database record, stripping its playlist assignments and custom metadata even though the underlying file remains. A public proof-of-concept curl command is included in the GitHub advisory.