Summary
A command injection vulnerability in luci-app-advanced-reboot allows an authenticated delegated LuCI session to execute attacker-controlled commands through an overly broad rpcd permission for /bin/sh.
When the affected ACL is present, supplied parameters can cause commands to run with root privileges on the OpenWrt device.
Affected context
The issue occurs in OpenWrt deployments using luci-app-advanced-reboot configurations that grant rpcd file.exec access to the general-purpose /bin/sh interpreter. It requires a delegated authenticated session with access to the relevant read ACL and a request path that forwards caller-controlled parameters to the authorized executable. Builds that do not include this shell execution grant are not affected by this specific exploitation chain.
Exploit preconditions
- Attack surface: LuCI web interface and its rpcd-backed application methods
- Required access: An authenticated delegated session authorized by the affected ACL
- Trigger point: A reboot operation or related RPC request that passes caller-controlled parameters to
/bin/sh - Why exploitation is possible: rpcd authorizes the shell executable but does not sufficiently restrict the arguments supplied to it, allowing shell command interpretation with the privileges of the rpcd process
Why this happens
The underlying flaw is excessive execution authority combined with insufficient argument control. The ACL grants permission to execute a general-purpose shell rather than a narrowly scoped helper, while caller-controlled parameters reach that interpreter without adequate separation between data and shell syntax.
This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, because untrusted input can influence command interpretation and execution.
Potential impact
- An attacker may execute arbitrary operating-system commands
- The router could be fully compromised with root privileges
- Configuration, credentials, and network traffic could be exposed
- Firewall, routing, or DNS settings could be altered
- The device could be used for persistence, lateral movement, or further attacks
General mitigation guidance
Mitigation generally focuses on removing shell interpretation from web-triggered operations and minimizing execution authority.
Common defensive patterns include:
- Replace general
/bin/shexecution with narrowly scoped, fixed-function helper operations - Use structured arguments and strict allowlists instead of concatenated shell commands
- Validate and constrain every parameter before it reaches an execution boundary
- Remove broad rpcd
file.execpermissions from delegated ACLs - Apply least-privilege identities and capabilities to RPC services
- Treat authenticated delegated sessions as potentially limited-trust principals
- Use read-only or policy-controlled configuration where feasible
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules identifying web or RPC parameters passed to shell interpreters
- Code review checks for
file.execACL entries targeting general-purpose shells - Searches for command construction, string concatenation, or unescaped arguments near process execution APIs
- Policy enforcement that blocks delegated permissions for interpreters and other general-purpose executables
- Runtime monitoring of rpcd-launched processes, unusual shell children, and unexpected root-level command activity
- Automated security review tools that flag command execution paths and overly broad authorization rules
