Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a critical vulnerability in an application managing containers on OpenWrt systems. The issue allows authenticated users with low privileges to gain unauthorized access to sensitive container management functions, potentially leading to the execution of malicious code on the host system with administrative privileges. The primary concern is to confirm if this specific application is in use and exposed.
- Unauthenticated access to container controls.
- Confirms exposure of container management functions.
- Assess relevance and potential exposure.
Attack Path
How an attacker could exploit the issue
An attacker with low-level authenticated access to the LuCI web interface can exploit an ACL inconsistency in the luci-app-lxc component. By manipulating the `lxc_name` parameter with path traversal, they can bypass authorization checks, access sensitive routes, and ultimately execute arbitrary code on the host system through container start-up hooks.
- Authenticated access to LuCI interface.
- Path traversal to execute host scripts.
- Root code execution on the host.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an authenticated user with low privileges on the LuCI web interface to execute arbitrary commands on the OpenWrt host system with root privileges. This could occur when the affected application is used to manage LXC containers, and an attacker manipulates specific parameters to escape container directories and trigger host-side scripts.
- Root code execution on the host.
- Path traversal to escape container.
- Host script execution with root privileges.
Operational Fix
Recommended remediation, mitigation, and detection steps
The Luci-app-lxc vulnerability impacts OpenWrt systems and requires immediate attention from teams managing the OpenWrt infrastructure and any associated container environments. The first step is to identify all OpenWrt hosts running luci-app-lxc, assess their network exposure, and confirm criticality before proceeding with remediation planning.
- Infrastructure and platform teams own remediation.
- Verify affected OpenWrt host exposure and criticality.
- Plan risk-based remediation with vendor coordination.
