Azuracast
Monthly
Remote code execution in AzuraCast ≤0.23.8 is reachable by any authenticated station manager due to a serialization group mismatch that exposes Liquidsoap custom configuration fields through the profile-edit API endpoint, which enforces only the lower-privilege StationPermissions::Profile rather than the StationPermissions::Broadcasting required by the dedicated Liquidsoap configuration endpoint. An attacker injects arbitrary Liquidsoap script constructs - including process.run() or process.exec() OS command primitives - into fields that ConfigWriter::writeCustomConfigurationSection() emits verbatim into the generated .liq script, with execution triggered automatically by the built-in sync task whenever needs_restart is set. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the attack path is fully described in advisory GHSA-q8wg-3qg7-8pc7 and presents a straightforward escalation from station manager to host OS command execution.
Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository azuracast/azuracast prior to 0.18. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Remote code execution in AzuraCast ≤0.23.8 is reachable by any authenticated station manager due to a serialization group mismatch that exposes Liquidsoap custom configuration fields through the profile-edit API endpoint, which enforces only the lower-privilege StationPermissions::Profile rather than the StationPermissions::Broadcasting required by the dedicated Liquidsoap configuration endpoint. An attacker injects arbitrary Liquidsoap script constructs - including process.run() or process.exec() OS command primitives - into fields that ConfigWriter::writeCustomConfigurationSection() emits verbatim into the generated .liq script, with execution triggered automatically by the built-in sync task whenever needs_restart is set. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the attack path is fully described in advisory GHSA-q8wg-3qg7-8pc7 and presents a straightforward escalation from station manager to host OS command execution.
Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository azuracast/azuracast prior to 0.18. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.