GHSA-93fx-5qgc-wr38

## Summary AzuraCast's `ConfigWriter::cleanUpString()` method fails to sanitize Liquidsoap string interpolation sequences (`#{...}`), allowing authenticated users with `StationPermissions::Media` or `StationPermissions::Profile` permissions to inject arbitrary Liquidsoap code into the generated configuration file. When the station is restarted and Liquidsoap parses the config, `#{...}` expressions are evaluated, enabling arbitrary command execution via Liquidsoap's `process.run()` function. ## Root Cause **File:** `backend/src/Radio/Backend/Liquidsoap/ConfigWriter.php`, line ~1345 ```php public static function cleanUpString(?string $string): string { return str_replace(['"', "\n", "\r"], ['\'', '', ''], $string ?? ''); } ``` This function only replaces `"` with `'` and strips newlines. It does **NOT** filter: - `#{...}` — Liquidsoap string interpolation (evaluated as code inside double-quoted strings) - `\` — Backslash escape character Liquidsoap, like Ruby, evaluates `#{expression}` inside double-quoted strings. `process.run()` in Liquidsoap executes shell commands. ## Injection Points All user-controllable fields that pass through `cleanUpString()` and are embedded in double-quoted strings in the `.liq` config: | Field | Permission Required | Config Line | |---|---|---| | `playlist.remote_url` | `Media` | `input.http("...")` or `playlist("...")` | | `station.name` | `Profile` | `name = "..."` | | `station.description` | `Profile` | `description = "..."` | | `station.genre` | `Profile` | `genre = "..."` | | `station.url` | `Profile` | `url = "..."` | | `backend_config.live_broadcast_text` | `Profile` | `settings.azuracast.live_broadcast_text := "..."` | | `backend_config.dj_mount_point` | `Profile` | `input.harbor("...")` | ## PoC 1: Via Remote Playlist URL (Media permission) ```http POST /api/station/1/playlists HTTP/1.1 Content-Type: application/json Authorization: Bearer <API_KEY_WITH_MEDIA_PERMISSION> { "name": "Malicious Remote", "sourc