GHSA 4h6m Rrxm 7w3m

A station "Remote Relay" URL (used by AzuraCast to periodically poll an external Icecast/Shoutcast-style server for Now Playing / listener statistics) is validated only for URL syntax and scheme ( http / https ). Unlike the Webhook feature (see companion advisory), there is no host/IP restriction whatsoever — not even the partial link-local check present elsewhere. A user holding only the station-scoped RemoteRelays permission can point this at any internal/loopback/private address and the server will automatically and repeatedly fetch it in the background.

backend/src/Entity/StationRemote.php :

Utilities\Urls::parseUserUrl() ( backend/src/Utilities/Urls.php ) only checks that the scheme is http / https and normalizes the URI — no IP/hostname check of any kind is performed anywhere in this code path.

backend/src/Radio/Remote/AbstractRemote.php :

This is invoked as part of AzuraCast's periodic background sync for any station with a configured Remote Relay, meaning the SSRF request is issued automatically and repeatedly (not just once on save), without further interaction from the attacker.

Configuring a Remote Relay requires only the station-scoped StationPermissions::RemoteRelays permission ( backend/config/routes/api_station.php : Middleware\Permissions(StationPermissions::RemoteRelays, true) ), not a full/global administrator role.

Verified via static code tracing (no live AzuraCast instance was started for this specific finding): Urls::parseUserUrl() was read in full and contains no IP/hostname-restriction logic of any kind — confirmed by inspection of backend/src/Utilities/Urls.php (reproduced in full below), which is the only validation function in the call chain from StationRemote::getUrlAsUri() to the outbound HTTP request.

No call to IP::create() , isLinkLocal() , or any equivalent appears anywhere in this file or in StationRemote.php . This can be confirmed by setting a Remote Relay URL to / or on a test station and observing that it is accepted and the periodic sync task issues the request (background job App\Sync\Task\* invoking AbstractRemote::getNowPlayingAsync ) rather than being rejected at save time.

A user with only the narrow RemoteRelays station permission (not a full server administrator) can cause the AzuraCast server to repeatedly and automatically issue outbound HTTP requests to any loopback, internal-network, or cloud-metadata address, with no bypass technique required (unlike the Webhook SSRF, there is no filter to defeat at all). This enables internal network reconnaissance and interaction with internal-only services from a low-privilege, single-station-scoped account.

Apply the same centralized SSRF protection recommended in the companion Webhook advisory to Utilities\Urls (or a shared validator used by both StationRemote and the Webhook connectors), covering loopback, RFC1918 private ranges, link-local, and IPv6 equivalents, with the check performed against the actually-resolved IP (not skipped for hostnames).