Icecast Config Exposure Scanner

Icecast is an audio streaming server used by internet radio stations and other streaming media services. It is developed and maintained by the Xiph.Org Foundation, and is designed to provide a way for audio content creators to share their streams with audiences across the world. This software is widely used by hobbyists and professional broadcasting services due to its flexibility and support for multiple streaming formats. Major stations use Icecast to distribute their live content to listeners, ensuring accessibility and broad reach. The platform supports various codecs and can be deployed on numerous operating systems, making it versatile for different streaming needs.

The vulnerability detected by this scanner pertains to the exposure of Icecast configuration files. Configuration files often contain sensitive information and expose critical settings, which, if accessible by unauthenticated entities, can pose security risks. This exposure could lead to an unauthorized modification of server settings or could provide attackers with information on how the system operates. The vulnerability is usually caused by improper server configurations or default settings that fail to secure these configuration files. Protecting these files is essential to maintaining the server's integrity and security, preventing unauthorized access or service disruption.

This vulnerability involves the exposure of the Icecast configuration file, typically located as "icecast.xml". The endpoint path generally involves accessing the server's base URL followed by "/icecast.xml". When this file is publicly accessible without appropriate safeguards, it may contain elements like "<hostname>" and "<fileserve>", which provide details about the server's configuration. If a GET request to this path returns the configuration file without authentication, it indicates a misconfiguration that could potentially be exploited. Identifying the status code of 200 and the content type of "application/xml" often confirms this exposure.

When malicious individuals exploit this vulnerability, they can gain insights into the server's configuration and operational details. This can potentially lead to unauthorized access, allowing attackers to disrupt broadcasts or manipulate streaming settings. It could also expose internal server details, making the server more susceptible to targeted attacks. These actions can severely affect the service's availability and reliability, risking loss of broadcast integrity and listener trust.

REFERENCES

• https://icecast.org/docs/icecast-trunk/config_file/