Stored CSV formula injection in AzuraCast bulk media exports

AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/{station_id}/files/bulk so formulas evaluate when other users open exported CSVs in spreadsheets.

• AzuraCast AzuraCast versions from 0 through before 0.24.0 are identified as affected.
• The affected deployment condition is a station where a user with the Media permission can perform bulk media imports and the resulting metadata is later included in bulk CSV exports.
• 0.24.0 is explicitly marked unaffected by the CNA/vendor evidence.
• The status of parallel branches or releases later than the explicitly documented boundary is not independently established by the reviewed sources.

AzuraCast processes user-controlled media metadata through its station bulk media import and export flow. An authenticated station user with the Media permission can submit titles, artist names, albums, genres, lyrics, ISRC values, extra metadata, or custom fields containing formula prefixes through POST /api/station/{station_id}/files/bulk. The values are stored and may later be included when another user requests GET /api/station/{station_id}/files/bulk.

When the resulting CSV is opened in a spreadsheet application that evaluates formulas, values beginning with =, +, -, @, a tab, or a carriage return may be interpreted as formulas instead of literal text. This is CWE-1236, Improper Neutralization of Formula Elements in a CSV File. The advisory states that the data flow was confirmed through source-code analysis, but the formula evaluation result was not dynamically reproduced during the assessment. The complete implementation details of the patch are not established by the returned sources.

The flaw is reachable over the network by an authenticated station user who has the Media permission; administrator privileges are not required. The main precondition is that this user can perform bulk media imports, followed by another user downloading and opening the exported CSV in a spreadsheet application that supports formula evaluation. Opening the file is an interaction by the target user, so the payload does not execute automatically merely because it is stored on the server. The record identifies public proof-of-concept material, and the advisory provides benign reproduction steps; however, the advisory says the effect was not dynamically reproduced during that assessment. The reviewed evidence does not establish unauthenticated exploitation, server-side code execution, execution inside the AzuraCast process, or operating-system command execution.

A user with the Media permission can influence stored station data by placing formula-prefixed metadata into the bulk media import flow. When another user downloads and opens the CSV in a compatible spreadsheet application, the affected cell may be calculated as a formula instead of displayed as literal text.

Possible consequences include altered displayed data, misleading reports or calculations, invocation of spreadsheet-supported external resources, and under suitable conditions disclosure of information accessible to the spreadsheet. The outcome depends on the spreadsheet application, its security configuration, and the actions of the person opening the file. The flaw is not described as providing unauthorized AzuraCast access, server-side code execution, or service disruption.

The flaw can alter how media data is displayed in spreadsheets, causing misleading calculations or reports and reducing trust in exported station data. Depending on the spreadsheet application, version, security settings, and user actions, a formula may invoke external resources supported by that application. Under some conditions, this could disclose information accessible to the spreadsheet, but the advisory does not confirm a specific disclosure scenario.

The primary exposure is to users who open the CSV and to downstream workflows that process the file, not to automatic code execution by AzuraCast. The advisory also does not claim server-side code execution, execution within the AzuraCast process, or operating-system command execution.

1. Upgrade AzuraCast to 0.24.0, the release identified by the CNA/vendor source as patched or unaffected. Do not automatically infer the status of unverified parallel branches.
2. Review existing media records, extra metadata, and station custom fields, then remove or safely encode values that a spreadsheet could interpret as formulas before distributing CSV files.
3. In custom forks or integrations that generate CSV files, apply a consistent spreadsheet-safe encoding policy to every user-controlled exported cell, including formula prefixes such as =, +, -, @, tab, and carriage return.
4. Until the upgrade is applied, reduce Media permissions to the minimum necessary and require users to inspect CSV files with a text editor or a safe review process before opening them in a spreadsheet. This reduces risk but does not replace the fix.
5. The reviewed sources do not provide a separate deployment workaround beyond upgrading and neutralizing exported data.

Use the following checks to assess exposure:

1. Inventory AzuraCast instances and identify deployments in the affected release range listed in affected_summary.
2. Review station users with the Media permission, especially accounts able to perform bulk media imports.
3. Inspect media metadata, extra metadata, and station custom fields for values beginning with =, +, -, @, a tab, or a carriage return. Use a parser or text editor rather than opening the file directly in a spreadsheet that may evaluate formulas.
4. Review bulk media CSV exports before they are distributed or opened, and flag cells that resemble formulas.
5. If application audit logs are available, review POST /api/station/{station_id}/files/bulk requests associated with users holding the Media permission. This is precautionary monitoring, not a dedicated IOC confirmed by the advisory.

The absence of suspicious values in one export should not be treated as proof that all stored metadata is safe.