Vulnerabilidad · Publicado 27/09/2026
AzuraCast antes de la versión 0.23.8 contiene vulnerabilidades de Server-Side Request Forgery (SSRF) y lectura de archivos locales en el módulo AutoDJ de obtención de playlists remotas. Un usuario con permisos de Media en la estación puede crear playlists con URLs remotas que apunten a rutas file:// o direcciones internas (loopback/link-local), exponiendo información sensible del servidor. Afecta principalmente a emisoras de radio online y plataformas de streaming en LATAM que utilizan este software para automatizar contenido.
AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch (backend/src/Radio/AutoDJ/QueueBuilder.php, getMediaFromRemoteUrl()). A user with the station Media permission can create or update a playlist with source=remote_url and remote_type=playlist whose remote_url points at a file:// path or an internal/loopback/link-local HTTP endpoint. When AutoDJ builds the queue, the backend passes the user-supplied URL directly to file_get_contents() with no scheme allowlist and no private/loopback/metadata IP policy (PHP allow_url_fopen is enabled by default, including in the Docker image). Lines from the fetched resource are parsed as M3U/PLS entries, stored in StationQueue.autodj_custom_uri, and returned by GET /api/station/{station_id}/queue to any user with the Broadcasting permission, disclosing host files readable by the web container (for example /etc/passwd or the application .env) and the bodies of non-blind internal HTTP requests. No patched version was available at the time of publication.
Score: 7.7/10 — Severidad: HIGH — Estado NIST: Received
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CWE-918
Publicado en NIST NVD.