Description
AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program that executes OS commands as root when configuration regenerates.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AzuraCast | AzuraCast | ≤ 0.23.8 | — |
References
- GitHub Security Advisory (GHSA-23wx-88m8-pfm2) vendor-advisory
- VulnCheck Advisory: AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone third-party-advisory