Executive brief
AzuraCast is a streaming radio server management platform that automatically syncs station metadata from remote sources. A flaw in URL validation for "Remote Relay" configurations allows a low-privileged user to cause the server to repeatedly make HTTP requests to internal IP addresses, cloud metadata services, or localhost resources. An attacker could probe internal networks, extract cloud credentials, or interact with services that should only be accessible internally.
Technical details
The vulnerability is a server-side request forgery (SSRF) in the StationRemote::getUrlAsUri() and AbstractRemote::getNowPlayingAsync() code path. URL validation via Utilities\Urls::parseUserUrl() checks only HTTP/HTTPS scheme syntax and does not restrict loopback, RFC1918 private, link-local, or cloud-metadata IP ranges. A user holding the station-scoped RemoteRelays permission (not requiring full admin) can set a Remote Relay URL to an internal address, and the periodic background sync task will automatically and repeatedly fetch that URL, issuing unauthenticated HTTP requests to internal resources.
Affected products
- AzuraCast AzuraCast before 0.23.8
Timeline
- 2026-09-27: disclosed: Public advisory released
- 2026-07-31: other: Vulnerable code present in main branch as of commit bcf8754eef3a268ad82c3db4d81f7920c3c28b56