Summary
luci-app-dockerman on recent OpenWrt snapshots contains an OS command injection issue in its ucode docker_rpc.uc backend, where request parameters are concatenated into a shell command and executed with system().
An authenticated user with only the package's broad "read" ACL can send crafted ubus requests to inject shell metacharacters and run arbitrary commands as root via the docker.container.ttyd_start method.
Affected context
The vulnerability occurs in OpenWrt deployments using luci-app-dockerman on LuCI master and openwrt-25.12 snapshots that include the ucode-based docker_rpc.uc backend.
In this context, the package's read ACL grants ubus access to docker.* and docker.container.* methods, including docker.container.ttyd_start, even though it performs mutating operations.
The backend runs within the rpcd process under root, constructs a shell command from request-controlled fields, and executes it without proper quoting or argument separation.
Exploit preconditions
- Attack surface: HTTP(S) access to the OpenWrt LuCI/ubus interface exposing luci-app-dockerman's RPC methods
- Required access: Valid authenticated session with the luci-app-dockerman read ACL (no additional administrative or write privileges required)
- Trigger point: Sending a crafted HTTP POST to
/ubusinvokingdocker.container.ttyd_startwith maliciousid,cmd, oruidparameters - Why exploitation is possible: The run_ttyd handler builds a shell command by concatenating user-controlled values and passes it to
system()in the rpcd root context, without quoting, escaping, or argv-style execution, enabling shell metacharacter injection
Why this happens
This vulnerability stems from constructing shell commands by string concatenation of untrusted input and executing them through a generic shell interpreter.
The run_ttyd handler in the ucode docker_rpc.uc backend uses request-controlled fields (id, cmd, uid) to build a command line for system(), which invokes /bin/sh -c under the hood.
Because the parameters are not validated, sanitized, or passed as discrete argv elements, the shell interprets metacharacters such as ;, &&, or backticks as control operators.
This behavior aligns with CWE-78: Improper Neutralization of Special Elements used in an OS Command, where user input is incorporated into a command string without neutralizing shell syntax.
Potential impact
- Execution of arbitrary OS commands as root within the OpenWrt router environment
- Complete compromise of the device, including configuration, logs, and locally stored data
- Installation of persistent malware, backdoors, or surveillance tooling on the router
- Use of the compromised router as a pivot point for attacks on internal networks or connected devices
- Modification or control of Docker containers and workloads managed via luci-app-dockerman
General mitigation guidance
Mitigation focuses on removing unsafe shell invocation patterns and tightening authorization boundaries around mutating RPC methods.
At the code and design level, defensive patterns include:
- Replacing string-based
system()calls with safer APIs that accept argument arrays and avoid shell interpretation (e.g., exec-style primitives) - Separating command construction from user input by mapping only validated identifiers to fixed command templates
- Enforcing strict input validation and allowlists for fields such as container IDs, user IDs, and subcommands, rejecting unexpected characters or formats
- Ensuring that ACL definitions reflect the true mutating nature of RPC methods so that "read" privileges cannot invoke state-changing or command-executing operations
- Running RPC backends and helpers with the least privileges necessary, reducing the blast radius if a similar flaw appears
Operationally, administrators can:
- Restrict access to the LuCI web interface and ubus endpoints to trusted management networks or VPNs
- Minimize exposure of luci-app-dockerman to accounts and roles that do not require Docker management capabilities
How teams detect issues like this
Detection can combine code-centric analysis with runtime monitoring:
- Static analysis: Search for uses of
system(), backtick execution, or similar shell wrappers where arguments include request- or ubus-controlled data; flag patterns that concatenate user input into command strings. - Code review: Pay attention to RPC handlers that:
- Run as root or elevated privileges
- Invoke external programs or shells
- Accept parameters like
id,cmd,uid, or other free-form strings without validation
Review ACL definitions to identify methods exposed under permissive "read" scopes despite performing mutations.
- Policy enforcement: Introduce secure coding guidelines banning direct shell command construction in RPC backends and require argument-vector execution and strict allowlisting.
- Runtime monitoring: Log and monitor ubus invocations to
docker.container.ttyd_startand similar methods, watching for anomalous parameters containing shell metacharacters or unexpected command patterns.
Automated code review tools and custom linters can help enforce policies by flagging dangerous command execution constructs and overly broad ACLs in CI pipelines.
