AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()

Summary

AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereo_tool_configuration_path or stereo_tool_license_key, which are executed via /bin/sh on station restart, compromising the container.

Remediation

1. Inventory every AzuraCast AzuraCast deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Advisoryhttps://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-c45c-wrcp-22fx
• Advisoryhttps://www.vulncheck.com/advisories/azuracast-through-0.23.8-command-injection-via-stereotool-liquidsoap-pipe