AzuraCast Installation Page Exposure Detection Scanner

AzuraCast is a self-hosted, all-in-one web radio management tool used by broadcasters and audio streaming enthusiasts worldwide. It allows for easy station setup, configuration, and management without needing extensive technical expertise. AzuraCast provides features like streamlined web-based interfaces, integrations with web hooks, and API access, making it popular among radio stations and DJs. Broadcasters use it to manage playlists, scheduling, and listeners on the cloud or on their servers. The software can easily integrate into various digital asset management systems. Its versatility and ease of use make it widely chosen in both professional and hobbyist radio broadcasting environments.

The vulnerability detected by this scanner involves exposing the setup wizard endpoints in AzuraCast installations. An unfinished installation of AzuraCast can allow unauthorized individuals to create superuser accounts. This grants malicious users full control over the application, leading to possible unauthorized access and system configuration changes. Once an unauthorized account is created, the integrity, confidentiality, and availability of the system can be compromised. Such exposure poses a significant security risk, as malicious users may gain admin-level access without any authentication. This vulnerability is critical in systems where the setup wizard remains accessible after the initial installation.

Technical details of this vulnerability include the exposure of the endpoint '{{BaseURL}}/setup/register' which should only be accessible during the installation process. The endpoint allows for the execution of subsequent setup steps, including creation of administrator accounts, which under normal circumstances require authenticated access. Furthermore, the existence of specific words like Set Up AzuraCast' in the response, along with HTTP status code of 200, confirms the exposure. When the setup wizard is not properly secured or closed, it results in this kind of unintended access point vulnerability. By exploiting knowledge of a typical AzuraCast installation flow, attackers can unwarrantly gain administrative privileges.

Exploiting this vulnerability can lead to severe consequences such as unauthorized data access, manipulation of streaming services, and complete takeover of the application. Malicious entities might change configurations, intercept data streams, or even delete content, leading to disruption of services. Such exploitation could endanger user data privacy and disrupt broadcasting operations, potentially impacting reputation and financials. The operational integrity of the broadcasting setup can be at risk, reducing the trust of listeners and clients. In cases of severe impact, it might result in permanent loss of important broadcast data.

REFERENCES

• https://github.com/AzuraCast/AzuraCast
• https://docs.azuracast.com/en/getting-started/installation