azuracast-installer: AzuraCast - Unfinished Installation

2026-04-09 AzuraCast PoC Public

Description

Detected exposed AzuraCast setup wizard that allows unauthorized superuser account creation.An unfinished AzuraCast installation exposes setup endpoints that enable attackers to create

administrator accounts and gain full control of the application.

PoC

id: azuracast-installer

info:
  name: AzuraCast - Unfinished Installation
  author: DhiyaneshDk
  severity: high
  description: |
    Detected exposed AzuraCast setup wizard that allows unauthorized superuser account creation.An unfinished AzuraCast installation exposes setup endpoints that enable attackers to create
    administrator accounts and gain full control of the application.
  reference:
    - https://github.com/AzuraCast/AzuraCast
    - https://docs.azuracast.com/en/getting-started/installation
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"Set Up AzuraCast"
  tags: misconfig,azuracast,exposure,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/setup/register"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Set Up AzuraCast"
          - "SetupRegister"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100fb7b808c1937d346b8cd835c075a37f5080fd29313411979f56daf5e50b26c14022031ce73725abd59d31ead26cf4e43ce0d1e39b7961ab5d61bb71e7462a779dca4:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/misconfiguration/installer/azuracast-installer.yaml

References

Related Vulnerabilities