Summary
AzuraCast's AutoDJ remote playlist feature may allow a station user with Media permission to make the server fetch local files or internal network resources. The fetched contents can be interpreted as playlist entries and later exposed through the station queue to users with Broadcasting permission, creating a server-side request forgery and local file disclosure risk.
Affected context
The issue may occur in AzuraCast deployments where the AutoDJ queue builder accepts user-controlled remote playlist URLs and passes them to PHP stream-fetching functionality without sufficiently restricting URI schemes or destination addresses. Risk is higher when URL fetching is enabled, the application container can access sensitive local files or internal services, and queue data is visible to users with appropriate station permissions.
Exploit preconditions
- Attack surface: AutoDJ remote playlist creation or update functionality
- Required access: A station user with Media permission to control playlist sources
- Trigger point: AutoDJ queue construction after a remote URL is configured
- Relevant input: A user-controlled
remote_urlassociated with a remote playlist source - Why exploitation is possible: The backend may fetch arbitrary schemes or internal destinations without a sufficiently restrictive scheme allowlist and private-address policy
- Disclosure path: Parsed entries may be persisted in the station queue and returned to users with Broadcasting permission
Why this happens
The underlying bug is server-side request forgery caused by treating a user-supplied URL as a trusted fetch target. The remote playlist handler passes that value to a file-fetching API without consistently restricting schemes, loopback and link-local destinations, private network ranges, or metadata endpoints. Because local-file and HTTP responses are subsequently processed as playlist data and stored for later retrieval, the issue can also produce local file disclosure and non-blind internal response disclosure. This behavior maps primarily to CWE-918: Server-Side Request Forgery.
Potential impact
- Sensitive host files readable by the web container may be disclosed
- Application secrets, configuration values, or credentials could be exposed
- Internal HTTP services may receive unintended requests
- Responses from reachable internal services may be returned to authorized queue viewers
- Network topology and service metadata may be revealed
- Compromised credentials could enable further application or infrastructure access
General mitigation guidance
Mitigation generally focuses on reducing trust in user-controlled fetch targets and separating playlist retrieval from the main application process.
Common defensive patterns include:
- Permit only explicitly required URL schemes, preferably HTTPS where remote fetching is necessary
- Resolve destinations and reject loopback, link-local, private, reserved, and metadata-service address ranges
- Revalidate destinations after DNS resolution and across redirects to reduce bypass and rebinding risks
- Prefer a dedicated fetcher with restricted network access, filesystem permissions, timeouts, and response-size limits
- Avoid exposing raw fetched content through queue or API responses
- Use structured playlist parsing and strict validation instead of treating arbitrary fetched lines as trusted entries
- Disable unnecessary URL-based filesystem access and apply least-privilege permissions to the web container
How teams detect issues like this
Detection can combine code review, static analysis, runtime monitoring, and policy enforcement.
- Search for user-controlled values reaching
file_get_contents(), URL openers, HTTP clients, or equivalent fetch APIs - Review URL handling for missing scheme allowlists, destination validation, redirect controls, and DNS-rebinding defenses
- Flag code paths that combine remote fetching with local-file-capable APIs or persist fetched response content
- Monitor outbound requests from application containers to loopback, private, link-local, and metadata-service addresses
- Audit API permissions that allow one role to configure remote sources while another role can read resulting queue data
- Enforce secure URL-fetching rules through static analysis, dependency policies, and automated code review checks
