Summary
AzuraCast contains a command injection vulnerability in live-recording configuration generation because a streamer username is not safely quoted before being passed to process execution calls.
An authenticated station user with Streamers and Profile permissions may be able to insert shell metacharacters into the username and cause commands to run as the Liquidsoap process user when recording ends.
Affected context
The vulnerability occurs in AzuraCast deployments that use the live-recording workflow and generate Liquidsoap configuration or process arguments from streamer-controlled usernames. Exploitation depends on an authenticated station user having the relevant Streamers and Profile permissions, with the affected value subsequently reaching a shell-sensitive process execution path when recording closes.
Exploit preconditions
- Attack surface: Live-recording configuration generation and process execution
- Required access: An authenticated station account with Streamers and Profile permissions
- Attacker-controlled input: The station streamer username
- Trigger point: Processing that occurs when a live recording closes
- Why exploitation is possible: The username is incorporated into a process execution call without sufficient shell-safe quoting or argument isolation
Why this happens
The underlying bug is improper neutralization of special elements in an operating system command. A user-controlled username reaches a process execution path without being treated strictly as data, allowing shell metacharacters to alter command interpretation.
This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection. The insecure pattern is constructing shell-sensitive commands from untrusted application data instead of using fixed executable arguments and safe process APIs.
Potential impact
- An attacker may execute commands with the privileges of the Liquidsoap process
- The application runtime could be modified or disrupted
- Recording data or station configuration could be accessed or altered
- Credentials and other secrets available to the process may be exposed
- The compromised process could be used for lateral movement, depending on deployment permissions
General mitigation guidance
Mitigation generally focuses on keeping user-controlled values out of shell interpretation and reducing the privileges available to media-processing workers.
Common defensive patterns include:
- Passing executable arguments through APIs that do not invoke a shell
- Applying strict allowlist validation to usernames and other identity fields
- Separating display values from process arguments and generated configuration
- Using safe quoting or escaping only as a defense-in-depth measure, not as the sole control
- Running Liquidsoap and related workers with least-privilege accounts and restricted filesystem access
- Limiting access to process environment variables, credentials, and network resources
- Enforcing authorization checks for station and profile-management operations
How teams detect issues like this
Organizations can look for command injection risks through:
- Static analysis rules identifying shell execution APIs fed by request, profile, or database values
- Code review checks for string concatenation or interpolation in process commands and generated media configurations
- Tests using inert metacharacter-containing input to verify that values remain single arguments
- Runtime monitoring for unexpected child processes, shell interpreters, or unusual commands launched by Liquidsoap
- Audit logging for streamer profile changes and recording lifecycle events
- Policy enforcement requiring shell-free process APIs and explicit input validation for security-sensitive fields
Automated code review and software composition tools may help identify unsafe process-execution patterns, but findings should be validated against the deployment's actual execution model.
