Luci App Adblock Fast
Monthly
Persistent root command execution in luci-app-adblock-fast prior to 1.2.4-2 on OpenWrt: an authenticated LuCI user who has been granted the component's write ACL can abuse the luci.adblock-fast.setCronEntry RPC by embedding carriage-return or line-feed characters in the entry argument. Because the value is serialized into /etc/crontabs/root as if it were a single line, the delegated user can create an additional physical cron entry that runs as UID 0 when cron executes. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 High) is directionally sound but materially gated by the mandatory pre-existing luci-app-adblock-fast write ACL and by cron actually running; exploitation is not demonstrated for unauthenticated users or users lacking that ACL. No public exploit identified at time of analysis, and the vendor fix is 1.2.4-2.
Persistent root command execution in luci-app-adblock-fast prior to 1.2.4-2 on OpenWrt: an authenticated LuCI user who has been granted the component's write ACL can abuse the luci.adblock-fast.setCronEntry RPC by embedding carriage-return or line-feed characters in the entry argument. Because the value is serialized into /etc/crontabs/root as if it were a single line, the delegated user can create an additional physical cron entry that runs as UID 0 when cron executes. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 High) is directionally sound but materially gated by the mandatory pre-existing luci-app-adblock-fast write ACL and by cron actually running; exploitation is not demonstrated for unauthenticated users or users lacking that ACL. No public exploit identified at time of analysis, and the vendor fix is 1.2.4-2.