An authorization bypass in AzuraCast allows authenticated users to perform unauthorized configuration changes, posing a significant risk of code injection.

This vulnerability involves an improper authorization check where sensitive Liquidsoap configuration endpoints fail to verify user permissions. An authenticated user with low privileges can leverage this flaw to perform unauthorized actions, potentially leading to code injection.

The ability to manipulate backend configuration files allows an attacker to inject arbitrary code into the radio stream processing engine. Given the CVSS score of 8.8, this represents a high-severity threat that could lead to full system compromise or service disruption. Unauthorized modifications to the radio backend may result in data loss, service outages, or the distribution of malicious content to listeners.

Immediate Action: Upgrade AzuraCast to the latest version immediately to ensure the required permission checks are correctly enforced.

Proactive Monitoring: Review application and audit logs for unusual configuration changes or attempts to access administrative endpoints by low-privileged users.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to restrict access to backend management endpoints to authorized IP addresses only.

Public Exploit Available: Unknown.

The high CVSS score and the existence of a proof-of-concept necessitate immediate attention. Organizations utilizing AzuraCast should prioritize applying the vendor provided update to close the authorization gap and prevent potential code injection attacks.