Description

AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backend_config property in backend/src/Entity/Station.php is annotated with GROUP_GENERAL, and PUT /api/station/{station_id}/profile/edit in backend/src/Controller/Api/Stations/ProfileEditController.php deserializes with that group while requiring only StationPermissions::Profile. AbstractArrayEntity::fromArray() then assigns every public property with no field-level permission check, so custom_config_top, custom_config, custom_config_pre_playlists, custom_config_pre_live, custom_config_pre_fade and custom_config_bottom are writable through it. ConfigWriter::writeCustomConfigurationSection() emits those values verbatim into the generated Liquidsoap .liq script, where the process.run() and process.exec() built-ins execute operating system commands when the backend restarts, which the built-in sync task triggers automatically once needs_restart is set. The dedicated endpoint for the same data, PUT /api/station/{id}/liquidsoap-config, requires StationPermissions::Broadcasting, so a station manager holding only the profile permission reaches configuration that the intended boundary reserves for broadcasting operators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-24T18:17:21.733Z",
  "pubdate": "2026-08-24T18:17:21.733Z",
  "executiveSummary": "AzuraCast suffers from a broken access control vulnerability that enables unauthorized modification of Liquidsoap custom configuration fields, ultimately leading to remote code execution. The vulnerability stems from a privilege enforcement discrepancy in the application backend, where the endpoint PUT /api/station/{station_id}/profile/edit utilizes the GROUP_GENERAL serialization group and requires only StationPermissions::Profile rather than the stricter StationPermissions::Broadcasting permission normally reserved for broadcasting operators.\nBy leveraging this misconfigured permission boundary, an authenticated attacker holding only profile-level permissions can modify sensitive configuration properties such as custom_config_top, custom_config, custom_config_pre_playlists, custom_config_pre_live, custom_config_pre_fade, and custom_config_bottom. These fields are subsequently written verbatim into the generated Liquidsoap .liq script by ConfigWriter::writeCustomConfigurationSection().\nBecause Liquidsoap supports built-in functions like process.run() and process.exec(), arbitrary operating system commands injected into these configuration fields are executed with the privileges of the backend process when the backend restarts. The application automatically triggers this restart process via its built-in sync task once the needs_restart flag is set.\nThe risk implication is critical, allowing lower-privileged station managers to escalate privileges and achieve complete system command execution on the host running the AzuraCast instance. Exploitation requires authenticated access with the StationPermissions::Profile capability.",
  "technicalDetails": "The root cause of the vulnerability lies in improper access control enforcement and incomplete field-level validation during API request deserialization within AzuraCast. Specifically, the backend_config property defined in backend/src/Entity/Station.php is annotated with the GROUP_GENERAL serialization group. The endpoint PUT /api/station/{station_id}/profile/edit, located in backend/src/Controller/Api/Stations/ProfileEditController.php, deserializes incoming payloads using this group while enforcing only the StationPermissions::Profile permission level.\nDuring the deserialization and assignment process, AbstractArrayEntity::fromArray() assigns every public property present in the payload without applying any field-level permission checks. This design flaw allows unprivileged or lower-privileged API clients to overwrite restricted properties, including custom_config_top, custom_config, custom_config_pre_playlists, custom_config_pre_live, custom_config_pre_fade, and custom_config_bottom. In contrast, the dedicated and properly secured endpoint for modifying these same configuration parameters—PUT /api/station/{id}/liquidsoap-config—correctly requires the StationPermissions::Broadcasting permission.\nThe exploitation flow proceeds as follows: First, an authenticated attacker possessing the StationPermissions::Profile permission sends a crafted HTTP PUT request to PUT /api/station/{station_id}/profile/edit containing malicious payload data injected into one of the vulnerable custom configuration fields. Second, the backend processes the request via ProfileEditController.php, bypassing the intended broadcasting authorization check due to the broad scope of GROUP_GENERAL and the lack of field-level validation in AbstractArrayEntity::fromArray(). Third, the malicious configuration values are saved to the station entity and processed by ConfigWriter::writeCustomConfigurationSection(), which emits the supplied strings verbatim into the generated Liquidsoap .liq script.\nUpon subsequent backend restarts—which are automatically triggered by the built-in sync task once the needs_restart condition is satisfied—the Liquidsoap engine evaluates the generated .liq script. If the injected configuration contains Liquidsoap built-in primitives such as process.run() or process.exec(), the underlying operating system executes the embedded commands. This results in arbitrary command execution on the underlying host operating system, leading to full system compromise or unauthorized administrative control over the affected station environment."
}