Description
AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows users with station WebHooks permission to bypass the UserUrlFilter SSRF guard through HTTP redirects. Attackers can configure Mastodon, Telegram, GroupMe, or RadioReg webhooks pointing to a redirecting URL, causing the Guzzle client to reach internal services and expose responses via test logs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AzuraCast | AzuraCast | < 0.24.0 | 0.24.0 |
References
- GitHub Security Advisory (GHSA-3mcm-xm6c-fj44) vendor-advisory
- VulnCheck Advisory: AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connector Redirects third-party-advisory