CVE-2025-67737: 
PHP vulnerability analysis and mitigation

CVE-2025-67737 is a missing authorization vulnerability in AzuraCast, a self-hosted web radio management suite, where an internal SFTP event API endpoint was mistakenly exposed to the public-facing HTTP API. This allows an unauthenticated remote attacker with specific knowledge of a station's SFTP username and internal filesystem structure to craft HTTP requests that modify the station's database records. The vulnerability affects AzuraCast versions up to and including 0.23.1, and was disclosed on December 11, 2025, with a fix released in version 0.23.2. It carries a CVSS v3.1 base score of 3.1 (Low) per the GitHub Advisory, or 3.7 (Low) per NVD (Github Advisory, Feedly).

The root cause is CWE-862 (Missing Authorization): the /api/internal/sftp-event endpoint, intended exclusively for internal use by the sftpgo SFTP daemon, lacked any middleware to restrict access to localhost-only connections, making it reachable from the public internet (Github Advisory). An attacker can send a crafted HTTP POST request to this endpoint with a JSON body specifying an action (e.g., pre-delete), a valid SFTP station username, and a guessed or known internal file path, causing AzuraCast to delete the corresponding database record for that media file. The fix adds a RequireInternalConnection middleware to both /sftp-auth and /sftp-event routes, ensuring they only respond to requests originating from the internal HTTP service on localhost (AzuraCast Commit). Exploitation requires no authentication but does require prior knowledge of a valid SFTP username and the station's internal filesystem path structure.

Successful exploitation allows an unauthenticated attacker to delete database records for media files within a station, causing AzuraCast to lose playlist associations and custom metadata for those files. While AzuraCast will eventually rediscover the physical files and recreate their database records, the restored records will lack the original playlist memberships and custom metadata, disrupting station operations. There is no confidentiality impact (the endpoint returns no information about file existence), no availability impact on the underlying files themselves, and no lateral movement potential beyond the targeted station's database (Github Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, demonstrating a simple curl command to trigger the vulnerability (Github Advisory). There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.047% (15th percentile), indicating a low probability of exploitation in the near term (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify publicly accessible AzuraCast installations running version 0.23.1 or earlier. Enumerate the target's public HTTP API to confirm the /api/internal/sftp-event endpoint is reachable.
2. Obtain SFTP username: Determine a valid SFTP station username through social engineering, public station information, or brute-force attempts against the SFTP service.
3. Determine internal filesystem path: Infer or brute-force the internal filesystem structure of the station (e.g., /var/azuracast/stations/<station_name>/media/<filename>) based on AzuraCast's known default directory layout.
4. Craft malicious HTTP request: Send a POST request to the exposed endpoint with a pre-delete action and the target file path:

curl -s -X POST "http://<target>/api/internal/sftp-event" \
  -H "Content-Type: application/json" \
  -d '{"action": "pre-delete", "username": "<sftp_username>", "path": "/var/azuracast/stations/<station>/media/<file>.mp3"}'

5. Effect: AzuraCast deletes the database record for the specified media file, removing its playlist associations and custom metadata. The physical file remains, but the station's configuration is disrupted (Github Advisory).

• Network: Unexpected HTTP POST requests to /api/internal/sftp-event or /api/internal/sftp-auth originating from external IP addresses (i.e., not localhost/127.0.0.1 or the container's internal network).
• Logs: Web server or application access logs showing POST requests to /api/internal/sftp-event with JSON payloads containing "action": "pre-delete" or similar SFTP event actions from non-internal sources.
• Database: Sudden disappearance of media file records from the station database followed by recreation of those records without playlist associations or custom metadata, indicating unauthorized pre-delete events were processed.

Upgrade AzuraCast to version 0.23.2 or later, which adds the RequireInternalConnection middleware to the /api/internal/sftp-event and /api/internal/sftp-auth routes, restricting them to localhost-only access (Github Advisory, AzuraCast Commit). As a temporary workaround for installations that cannot immediately upgrade, network-level controls (e.g., firewall rules or reverse proxy configurations) should block external access to the /api/internal/ path prefix. Additionally, restrict knowledge of SFTP station usernames and internal filesystem paths to trusted personnel.

The vulnerability was reported by security researcher Cillian-Collins and published by AzuraCast maintainer BusterNeece on December 11, 2025 (Github Advisory). A technical write-up was published at infinitsec.net describing the issue as "Pre-Auth File Deletion & Admin RCE," though the advisory itself rates the severity as Low given the significant preconditions required for exploitation. No broader media coverage or notable community controversy has been identified.