Alpastx

**Name of the Vulnerable Software and Affected Versions** AzuraCast versions prior to 0.23.8 **Description** An issue exists in the AutoDJ remote playlist fetch functionality within the `getMediaFromRemoteUrl()` function. A user with station Media permissions can create or update a playlist by setting `source` to `remote url` and `remote type` to `playlist`. By providing a `remote url` that points to a `file://` path or an internal, loopback, or link-local HTTP endpoint, the backend passes this URL directly to `file get contents()` without a scheme allowlist or private IP policy. This allows for server-side request forgery (SSRF) and local file read. The fetched content is parsed as M3U/PLS entries and returned via the `GET /api/station/{station id}/queue` endpoint to users with Broadcasting permissions, potentially disclosing sensitive host files such as `/etc/passwd` or the application `.env` file, as well as the bodies of internal HTTP requests. **Recommendations** Update AzuraCast to version 0.23.8 or later. As a temporary mitigation, restrict the use of the `getMediaFromRemoteUrl()` function or limit the permissions for creating remote playlists until the update is applied.

**Name of the Vulnerable Software and Affected Versions** AzuraCast versions prior to 0.23.8 **Description** Broken access control allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. By calling the 'GET /api/station/{id}/vue/profile' endpoint, attackers with view-only access can obtain plaintext frontend credentials in the JSON response. These credentials can then be used to authenticate to the Icecast admin interface without requiring Broadcasting permission. **Recommendations** Update to version 0.23.8 or later.

**Name of the Vulnerable Software and Affected Versions** AzuraCast versions prior to 0.23.8 **Description** Command injection occurs during Liquidsoap configuration generation for live recording because the streamer username is not properly quoted in `process.run` calls. Authenticated station users possessing Streamers and Profile permissions can set a username containing shell metacharacters, allowing them to execute arbitrary commands as the Liquidsoap process user when a recording is closed. **Recommendations** Update to version 0.23.8 or later.