Description
AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString() method that fails to sanitize Liquidsoap string interpolation sequences, allowing authenticated users with Media or Profile permissions to inject arbitrary Liquidsoap code into station configuration. Attackers can inject #{process.run()} expressions into playlist URLs or station metadata fields that execute shell commands as the azuracast user when the station restarts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AzuraCast | AzuraCast | < 0.23.4 | 0.23.4 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | azuracast/azuracast | < 0.23.4 | 0.23.4 | GHSA-93fx-5qgc-wr38 |
References
- GitHub Security Advisory (GHSA-93fx-5qgc-wr38) vendor-advisory
- VulnCheck Advisory: AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation third-party-advisory