CyberRota Analysis
AI-GeneratedAzuraCast versions up to 0.23.x are vulnerable to a command injection flaw in the Liquidsoap configuration, allowing authenticated users with Streamers and Profile permissions to exploit improperly handled streamer usernames. This vulnerability can lead to arbitrary command execution as the Liquidsoap process user, posing a significant risk to system integrity and data security. Organizations using AzuraCast should prioritize patching this vulnerability to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell metacharacters and trigger command execution as the Liquidsoap process user when recording closes.