AzuraCast vulnerabilities

AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backend_config property in Station.php is annotated with GROUP_GENERAL, and PUT /api/station/{station_id}/profile/edit deserializes with that group while requiring only StationPermissions::Profile. AbstractArrayEntity::fromArray() then assigns every public property with no field-level permission check, so custom_config_top, custom_config, custom_config_pre_playlists, custom_config_pre_live, custom_config_pre_fade and custom_config_bottom are writable through it. ConfigWriter::writeCustomConfigurationSection() emits those values verbatim into the generated Liquidsoap .liq script, where the process.run() and process.exec() built-ins execute operating system commands when the backend restarts, which the built-in sync task triggers automatically once needs_restart is set. The dedicated endpoint for the same data, PUT /api/station/{id}/liquidsoap-config, requires StationPermissions::Broadcasting, so a station manager holding only the profile permission reaches configuration that the intended boundary reserves for broadcasting operators.

AzuraCast before version 0.23.6 has a vulnerability in the ApplyXForwarded middleware that unconditionally trusts the X-Forwarded-Host header without a trusted proxy allowlist. An unauthenticated attacker can poison the password reset URL by injecting this header during the forgot-password flow. When the victim clicks the link, the reset token is exfiltrated, allowing full account takeover and destruction of 2FA configuration.

A vulnerability in AzuraCast prior to version 0.23.6 allows an authenticated user with media management permissions to write arbitrary files outside the station's media storage directory via an unsanitized currentDirectory parameter in the Flow.js upload endpoint. This can lead to remote code execution by writing a PHP webshell.