Executive brief
AzuraCast is a self-hosted web radio management platform that allows stations to configure webhooks to send live broadcast data to external services. A flaw in webhook URL validation allows a user with basic webhook permissions to configure webhooks pointing to internal services or loopback addresses, forcing the server to send HTTP requests containing station data to internal targets. This enables attackers to access cloud metadata endpoints, internal APIs, or perform network reconnaissance without administrative privileges.
Technical details
The AbstractConnector::getValidUrl() method in the webhook validation logic only blocks literal link-local IP addresses (169.254.0.0/16 and fe80::/10) while failing to reject loopback addresses, RFC1918 private ranges, and hostnames. Hostname resolution throws an exception that causes the validation check to be skipped entirely, allowing any hostname to bypass protections. An attacker with station-scoped WebHooks permission can exploit the PUT /station/{id}/webhook/{id}/test endpoint to trigger requests on demand against internal targets.
Affected products
- AzuraCast AzuraCast before 0.23.8
Timeline
- 2026-09-27: disclosed
- 2026-08-07: advisory: GitHub Security Advisory GHSA-3jp3-3wqw-jvw4 published