External risk intelligence

Snapcast Remote Code Execution via JSON-RPC API

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-36177

Snapcast is a multi-room audio synchronization system typically deployed on local networks to distribute audio to connected clients. While it uses a JSON-RPC API that could be exposed, it is not designed as an internet-facing service or edge gateway, and public exposure is not the standard deployment pattern.

Code Injection

Badaix Snapcast

0.27.0 and earlier

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Snapcast software, specifically within its JSON-RPC API. This flaw could allow remote attackers to execute arbitrary code and access sensitive information without needing any credentials, potentially impacting systems that use this audio synchronization technology. The main concern is confirming whether this specific software is in use and if it's exposed in a way that malicious actors could exploit.

Remote code execution and data theft risk.
Confirms relevance and potential exposure.
Assess usage and network exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach a vulnerability in Snapcast's JSON-RPC API by sending specially crafted requests over the network. This interaction allows for the execution of arbitrary code and the potential exfiltration of sensitive information, essentially enabling the attacker to compromise the affected system.

Network exposure required.
Triggered by crafted JSON-RPC requests.
Risk: Code execution and data exposure.

Live Threat

Current exploitation, exposure, and threat context

Remote attackers could execute arbitrary code and access sensitive information when a crafted request is sent to the JSON-RPC API of Snapcast. This impacts systems where Snapcast is accessible over a network.

System code execution.
Network access to API.
Sensitive information disclosure.

Operational Fix

Recommended remediation, mitigation, and detection steps

The responsible teams for addressing this vulnerability depend on how Snapcast is deployed and managed within your environment. Typically, platform or infrastructure teams would oversee the Snapcast service itself, while application owners might be accountable if it's integrated into a specific user-facing application. The initial practical step is to inventory all Snapcast instances, determine their network exposure and business criticality, and identify the accountable owners to prioritize and plan remediation efforts, potentially involving vendor coordination for updates.

Platform or application owners should manage the issue.
Verify Snapcast instances and their exposure.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Snapcast?

Snapcast is a client-server software suite used to synchronize audio across multiple devices in a home or facility. It allows users to play the same audio stream simultaneously on various speakers or rooms by sending audio data over a network, creating a cohesive multi-room sound environment.

What does CWE-94 mean for CVE-2023-36177?

This CVE involves CWE-94, which is the Improper Control of Generation of Code. In plain terms, the software fails to properly filter instructions sent to it, allowing a crafted request to be interpreted as a command by the system. Because the JSON-RPC API is affected, the software unintentionally executes unauthorized actions or code provided by a remote sender.

How is this Snapcast vulnerability triggered?

The flaw is triggered by sending a specially crafted request to the JSON-RPC API. It does not occur through normal audio streaming activities or standard playback commands. The system must be reachable over a network, and an attacker must be able to send specific malformed API calls to force the application to perform unintended operations.

Is my Snapcast instance likely to be affected?

Halo Surface Signal indicates that Snapcast is designed for local network audio distribution and is not typically intended to be an internet-facing service. However, if your instance is inadvertently accessible from the internet, it faces a higher risk of being reached by unauthorized remote actors compared to systems strictly contained within a private, isolated network.

What steps should I take if I use Snapcast?

Begin by conducting an inventory to locate all instances of Snapcast running in your environment. Confirm their current network configuration to ensure they are not exposed to the public internet. Finally, coordinate with your infrastructure or platform owners to review your deployment and prepare for potential updates provided by the vendor to address this security concern.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.