Executive brief
AzuraCast is a self-hosted web radio management platform. A flaw in the profile editing API allows station managers with limited permissions to modify Liquidsoap audio backend configuration fields that should be restricted to broadcasting operators. Attackers can inject arbitrary commands into the Liquidsoap script, which executes them as the backend process when the service restarts, potentially compromising the entire radio station system.
Technical details
The vulnerability is a privilege escalation via insufficient authorization checks in the profile editing endpoint. The backend_config property in Station.php is annotated with GROUP_GENERAL, and the PUT /api/station/{station_id}/profile/edit endpoint deserializes user input with that group while requiring only StationPermissions::Profile permission. AbstractArrayEntity::fromArray() assigns all public properties without field-level permission validation, making custom_config_top, custom_config, custom_config_pre_playlists, custom_config_pre_live, custom_config_pre_fade, and custom_config_bottom writable by an attacker. ConfigWriter::writeCustomConfigurationSection() emits these values verbatim into the Liquidsoap .liq script where process.run() and process.exec() execute OS commands when the backend restarts (triggered automatically via the sync task). The dedicated /api/station/{id}/liquidsoap-config endpoint correctly requires StationPermissions::Broadcasting, but the profile endpoint bypasses this intended access control boundary.
Affected products
- AzuraCast AzuraCast before 0.23.8
Timeline
- 2026-08-24: disclosed