Description

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /opennds_preauth/ endpoint because of libopennds.sh.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-28T02:16:21.350Z",
  "pubdate": "2026-08-28T02:16:21.350Z",
  "executiveSummary": "The vulnerability identified in openNDS versions prior to 11.0.0 constitutes a critical OS command injection flaw.\nThis vulnerability resides within the processing logic of the /opennds_preauth/ endpoint, specifically affecting how the 'fas' query parameter is handled by libopennds.sh.\nThe flaw allows an unauthenticated, remote attacker to execute arbitrary shell commands with the privileges of the openNDS service process.\nBecause the vulnerability is exploitable without authentication and does not require pre-existing user sessions, it presents a significant risk to the confidentiality, integrity, and availability of the host system.\nSuccessful exploitation results in full remote code execution, enabling an attacker to gain unauthorized access to the underlying operating system, manipulate network traffic, exfiltrate sensitive data, or deploy persistent backdoors within the network gateway environment.",
  "technicalDetails": "The root cause of this vulnerability is the improper sanitization of user-supplied input provided through the 'fas' query parameter when interacting with the /opennds_preauth/ endpoint.\nThe underlying script, libopennds.sh, processes this parameter and passes it directly into a system shell execution context without adequate input validation or neutralization of shell metacharacters.\nAn attacker can exploit this by crafting a malicious HTTP GET request targeting the /opennds_preauth/ endpoint, appending a specifically formatted string to the 'fas' parameter that contains shell command operators, such as semicolons, pipes, or backticks.\nThe attack flow begins when the openNDS web server receives the crafted request. The backend handler, delegating the request logic to libopennds.sh, incorporates the malicious 'fas' parameter into a command string that is subsequently evaluated by the system shell (e.g., /bin/sh or /bin/bash).\nBecause the application logic does not employ safe API calls for command execution or utilize parameterization, the shell interprets the injected sequences as legitimate instructions.\nThis behavior facilitates arbitrary command execution, effectively bypassing the intended application-level security controls designed for the pre-authentication portal.\nAs openNDS typically operates with elevated privileges to manage network interfaces and firewall rules, an attacker executing commands through this vector gains the same privilege level, allowing for significant post-exploitation impact.\nThis impact extends to potential modifications of iptables rules, interception of client traffic, or complete compromise of the gateway device.\nThe vulnerability is present in all versions of openNDS prior to 11.0.0. The lack of authentication requirements makes this a highly accessible entry point for attackers positioned on the network segments that can reach the openNDS portal interface, including potentially untrusted pre-authentication zones."
}