Summary
AzuraCast contains a code injection vulnerability in its configuration string cleanup logic, which does not adequately neutralize Liquidsoap interpolation sequences. An authenticated user with Media or Profile permissions may inject expressions that execute shell commands as the AzuraCast service account when a station restarts.
Affected context
The vulnerability occurs in AzuraCast deployments where users with Media or Profile permissions can influence playlist URLs or station metadata that is incorporated into station configuration. Risk exists when those values are processed as Liquidsoap expressions during station restart rather than being treated strictly as data.
Exploit preconditions
- Attack surface: Authenticated station-management functionality - Required access: A valid account with Media or Profile permissions - Attacker-controlled input: Playlist URLs or station metadata fields - Trigger point: Station configuration generation or processing during restart - Why exploitation is possible: Liquidsoap interpolation sequences are not
sufficiently sanitized before user-controlled values reach the interpreter
Why this happens
The underlying flaw is improper neutralization of user-controlled input before it is embedded in an interpreted Liquidsoap configuration. The cleanup routine fails to remove or encode interpolation syntax, allowing data to be evaluated as executable Liquidsoap logic rather than remaining inert content. This maps to CWE-94, Improper Control of Generation of Code, because attacker-influenced input crosses a code-generation boundary without adequate separation or escaping.
Potential impact
- An attacker may execute arbitrary shell commands as the AzuraCast service account.
- The station runtime could be compromised.
- Application data, media, or configuration could be modified or accessed.
- Attackers could use the compromised service account for lateral movement, subject to its privileges.
- Station availability and broadcast operations could be disrupted.
General mitigation guidance
Mitigation generally focuses on preserving a strict boundary between station data and executable Liquidsoap configuration. Common defensive patterns include using structured APIs or parameterized configuration generation instead of string concatenation, encoding or rejecting interpolation delimiters in user-controlled fields, and applying context-aware validation before values reach the interpreter. Configuration processing should use secure-by-default templates, minimize the privileges of the AzuraCast service account, isolate station workers, and restrict who can edit media and profile data. Controls should also ensure that validation occurs before configuration is persisted or executed.
How teams detect issues like this
Detection can include static analysis for string concatenation or templating that places user-controlled values into Liquidsoap code, searches for interpolation delimiters handled by cleanup routines, and code review of playlist and metadata processing paths. Dynamic testing can submit benign delimiter-like input and verify that generated configurations preserve it as data rather than executable syntax. Policy enforcement may require approved templating libraries, schema validation, and automated security checks in pull requests. Neutral automated code-review tools can help identify interpreter-boundary violations.
