Listen to this Post
The vulnerability stems from an internal API endpoint (/api/internal/sftp-event) designed for communication between AzuraCast’s core application and its internal SFTP service (sftpgo) being incorrectly bound to the public-facing web interface. This endpoint processes events like file deletions from the SFTP server. A remote attacker with knowledge of a station’s SFTP username and internal file path structure could craft a malicious HTTP POST request to this publicly accessible endpoint. The request, simulating a `pre-delete` action from sftpgo, would cause AzuraCast to prematurely delete the database record associated with the specified media file path. While the system’s media synchronization would later recreate a basic file record, all custom metadata, playlist assignments, and playback history linked to the original entry would be permanently lost. The attack is blind, as the endpoint returns no data, and requires precise internal knowledge to execute successfully.
dailycve form:
Platform: AzuraCast
Version: < 0.19.1
Vulnerability: Internal API Exposure
Severity: Medium
date: 2024-05-15
Prediction: Patch 2024-05-16
What Undercode Say:
Curl request simulating malicious sftpgo event
curl -s -X POST "http://TARGET/api/internal/sftp-event" -H "Content-Type: application/json" -d '{"action":"pre-delete","username":"STATION_USER","path":"/var/azuracast/stations/station_name/media/file.mp3"}'
Example incorrect configuration exposing internal route
location ~ ^/api/internal {
This block was improperly accessible
proxy_pass http://azuracast_core;
}
How Exploit:
Attacker crafts POST request to public `/api/internal/sftp-event` endpoint with known station username and guessed file path to trigger premature database deletion.
Protection from this CVE:
Update to AzuraCast v0.19.1. Ensure internal API endpoints are restricted to localhost/container network only via web server configuration (e.g., Nginx allow 127.0.0.1; deny all;).
Impact:
Loss of media metadata, playlist associations, and play history. Requires manual administrator intervention to restore affected media entries.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
