Description

In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embedding semicolons in a URL query parameter name.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-28T02:16:21.620Z",
  "pubdate": "2026-08-28T02:16:21.620Z",
  "executiveSummary": "The openNDS captive portal framework is susceptible to an OS command injection vulnerability residing within the client_params.sh script, affecting all versions prior to 11.0.0.\nThe vulnerability occurs due to the insecure handling of HTTP GET query parameter keys, which are processed by the openNDS daemon and passed to a shell environment without sufficient input sanitization.\nSuccessful exploitation allows an authenticated captive portal user to execute arbitrary shell commands with the privileges of the openNDS process.\nThis flaw grants an attacker the capability to perform unauthorized system operations, potentially leading to full compromise of the underlying host environment.\nThe attack is remotely exploitable over the network by a captive portal client, necessitating only a valid session to trigger the vulnerable execution path.\nGiven the nature of captive portals, which often interact with sensitive network traffic, this vulnerability presents a significant risk to the integrity and availability of the infrastructure hosting the openNDS service.",
  "technicalDetails": "The vulnerability exists within the openNDS daemon, which facilitates interaction with the client_params.sh script to dynamically generate authenticated client status pages.\nThe root cause is improper input validation and sanitization of HTTP GET query parameters. Specifically, the daemon fails to adequately sanitize parameter keys before passing them into a shell execution context.\nWhen a user navigates to the portal, the application extracts query parameter names from the requested URL. Because the daemon passes these unsanitized keys directly into the client_params.sh script, the shell environment interprets special characters such as the semicolon (;) as command delimiters.\nThe attack flow proceeds as follows: 1) An attacker connects to the captive portal and authenticates. 2) The attacker crafts a malicious HTTP GET request targeting the status page, appending a payload to a query parameter name. For example, a request structure using 'parameter_name; <injected_command>' triggers the vulnerability.\nUpon receipt, the openNDS daemon invokes client_params.sh, passing the malicious input string. The underlying shell interprets the semicolon, terminates the intended command, and executes the attacker's payload as a secondary, subsequent command.\nBecause the daemon executes this script to serve dynamic status pages, the injected commands run with the privileges assigned to the openNDS daemon user, often requiring elevated or specific service account permissions depending on the system configuration.\nExploitation is facilitated by the network-accessible nature of the captive portal. Since the target is a gateway or router daemon, the impact is severe, potentially allowing an attacker to persist in the environment, pivot into the local network, or exfiltrate configuration data.\nThis command injection vector bypasses standard input parameter filtering, as the vulnerability targets the parameter key itself rather than the value, which may be subjected to different security controls.\nAffected versions include all openNDS releases prior to 11.0.0, as the script lacked the necessary shell meta-character escaping logic required to prevent command injection during the parameter parsing phase of page rendering."
}