CVE-2024-29026: Owncast Information Disclosure Vulnerability

CVE-2024-29026 Overview

CVE-2024-29026 is a critical Cross-Site Request Forgery (CSRF) vulnerability affecting Owncast, an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a lenient CORS (Cross-Origin Resource Sharing) policy allows attackers to make cross-origin requests, enabling them to read privileged information from authenticated sessions. This vulnerability can be exploited to leak the admin password, potentially giving attackers full control over the Owncast server instance.

Critical Impact

Attackers can exploit the lenient CORS policy to steal administrative credentials through cross-origin requests, leading to complete server compromise.

Affected Products

• Owncast versions 0.1.2 and prior
• All self-hosted Owncast streaming server instances running vulnerable versions
• Owncast Project Owncast (all deployments using affected versions)

Discovery Timeline

• 2024-03-20 - CVE-2024-29026 published to NVD
• 2025-10-14 - Last updated in NVD database

Technical Details for CVE-2024-29026

Vulnerability Analysis

The vulnerability resides in the authentication middleware of Owncast, specifically in the CORS configuration. The application implements an overly permissive CORS policy that fails to properly restrict which origins can make authenticated requests to the server. This architectural flaw allows malicious websites to craft requests that bypass the same-origin policy protections built into modern browsers.

When a user with administrative access visits a malicious website while authenticated to their Owncast instance, the attacker's site can make authenticated API requests to the Owncast server. Because the CORS policy does not properly validate the requesting origin, these cross-origin requests are processed with the victim's credentials, allowing the attacker to retrieve sensitive information including the admin password.

Root Cause

The root cause of this vulnerability lies in the improper implementation of CORS headers in the auth.go middleware file. The vulnerable code path at /router/middleware/auth.go line 32 contains a lenient CORS configuration that does not properly restrict allowed origins. This allows any external domain to make authenticated requests to the Owncast API endpoints, effectively bypassing browser-based security controls designed to prevent cross-site data theft.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction beyond the victim being logged into their Owncast admin panel. An attacker can host a malicious webpage that, when visited by an authenticated Owncast administrator, silently makes cross-origin requests to the victim's Owncast server. The lenient CORS policy allows these requests to succeed and return privileged data, including administrative credentials.

The attack flow involves hosting malicious JavaScript that targets the Owncast admin API endpoints. When the victim visits the attacker-controlled page while authenticated to their Owncast instance, the browser sends the request with the victim's session cookies. Due to the misconfigured CORS headers, the server accepts the request and returns sensitive data that the attacker's JavaScript can then exfiltrate to an attacker-controlled endpoint.

Detection Methods for CVE-2024-29026

Indicators of Compromise

• Unusual cross-origin requests to Owncast admin API endpoints from unexpected referrer domains
• Access logs showing API requests with non-local or suspicious Origin headers
• Multiple failed or successful authentication attempts from different geographic locations
• Unexpected administrative configuration changes or password modifications

Detection Strategies

• Monitor web server access logs for requests to /api/admin/ endpoints with suspicious or unexpected Origin headers
• Implement browser-based Content Security Policy (CSP) headers to detect and report policy violations
• Review authentication logs for signs of credential theft such as logins from new locations or devices
• Configure web application firewall (WAF) rules to flag cross-origin requests to sensitive endpoints

Monitoring Recommendations

• Enable verbose logging for all administrative API endpoints and review logs regularly
• Set up alerts for failed authentication attempts and successful logins from new IP addresses
• Deploy network monitoring to detect data exfiltration patterns following cross-origin requests
• Implement session monitoring to detect anomalous behavior patterns after authentication

How to Mitigate CVE-2024-29026

Immediate Actions Required

• Update Owncast to a version that includes commit 9215d9ba0f29d62201d3feea9e77dcd274581624 or later
• Rotate all administrative credentials immediately, especially if the server was exposed to the internet
• Review server access logs for any suspicious cross-origin request activity
• Implement network-level access controls to restrict admin panel access to trusted IP addresses

Patch Information

The vulnerability has been addressed in commit 9215d9ba0f29d62201d3feea9e77dcd274581624. Organizations running Owncast should update to a version containing this fix immediately. The patch corrects the CORS configuration in the authentication middleware to properly restrict allowed origins and prevent unauthorized cross-origin requests from accessing privileged API endpoints.

For detailed patch information, refer to the GitHub Commit Details.

Workarounds

• Place the Owncast server behind a reverse proxy that implements strict CORS policies
• Use network segmentation to limit access to the admin interface from trusted networks only
• Implement additional authentication layers such as VPN access for administrative functions
• Configure a web application firewall to block cross-origin requests to admin API endpoints

# Example nginx reverse proxy configuration to restrict CORS
# Add to your Owncast server block
location /api/admin/ {
    # Restrict to specific trusted origins only
    add_header 'Access-Control-Allow-Origin' 'https://your-trusted-domain.com' always;
    add_header 'Access-Control-Allow-Credentials' 'true' always;
    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
    
    # Deny requests from untrusted origins
    if ($http_origin !~* "^https://your-trusted-domain\.com$") {
        return 403;
    }
    
    proxy_pass http://localhost:8080;
}