Description
OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after the JS/ucode conversion) contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker.* / docker.container.*, which exposes the docker.container.ttyd_start method even though it performs mutating operations. The run_ttyd handler builds a shell command from the request-controlled id, cmd, and uid fields and passes it to system() without quoting or argv-style execution in the rpcd root context. An authenticated attacker holding only the luci-app-dockerman read ACL can inject shell metacharacters (e.g., in id) to execute arbitrary commands as root via an HTTP POST to /ubus. openwrt-24.10 and openwrt-23.05 do not contain this backend and are not affected; no patched version was known as of the advisory.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
openwrt luci
Default version status: unaffected
26.162.29621~507ab5eaffected
References
- https://github.com/openwrt/luci/security/advisories/GHSA-cq4h-h8jr-3xqv ↗
- https://github.com/openwrt/luci/commit/f4d0a44950e42bcbb8eacf715a3493b276a4f3ac ↗
- https://github.com/openwrt/luci/commit/44618b5b53d9bdad5cd489e82e29688b4d0862c1 ↗
- https://www.vulncheck.com/advisories/openwrt-luci-app-dockerman-read-acl-remote-code-execution ↗