Description

OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn() without any allowlist, blocklist, or argument validation. The authentication middleware becomes a no-op when UI_PASSWORD is not configured, matching the default Docker deployment, enabling attackers to execute arbitrary OS commands as the application user and retrieve full command output including stdout, stderr, and exit code from the server response.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-06T15:16:55.827Z",
  "pubdate": "2026-08-06T15:16:55.827Z",
  "executiveSummary": "OpenChamber version 1.11.7 contains an unauthenticated remote code execution vulnerability that exposes systems to severe compromise. The vulnerability resides in the handling of HTTP requests to the /api/fs/exec endpoint. Remote attackers can leverage this flaw to execute arbitrary shell commands on the underlying operating system as the application user.\nThe risk implication is critical, as successful exploitation yields full command execution capabilities and allows attackers to retrieve complete command output, including stdout, stderr, and the process exit code, directly within the server response. This flaw heavily impacts default Docker deployments, where the UI_PASSWORD environment variable is typically left unconfigured, causing the authentication middleware to become a complete no-op.\nThe attacker capabilities include unprivileged remote access over the network to execute arbitrary OS commands without supplying valid authentication credentials. Exploitation requirements are minimal when the default configuration is used, as the absence of UI_PASSWORD bypasses security checks entirely, allowing immediate and direct interaction with the vulnerable execution handler.",
  "technicalDetails": "The root cause of the vulnerability is the insecure design of the command execution mechanism within OpenChamber 1.11.7. Specifically, the /api/fs/exec endpoint accepts crafted POST requests and passes user-supplied input verbatim to the Node.js spawn() function. The application implements zero input validation, allowlists, or blocklists to filter or sanitize the parameters before execution.\nThe vulnerable component is the file system execution API route, specifically /api/fs/exec, operating within the Node.js backend environment. Affected versions include OpenChamber 1.11.7, where the lack of proper argument parsing and command structuring leads directly to command injection and remote code execution conditions.\nAuthentication requirements are effectively bypassed due to a flaw in the authentication middleware logic. When the UI_PASSWORD configuration variable is not set—which matches the default Docker deployment scenario—the authentication middleware functions as a no-op. Consequently, network-exposed instances require zero authentication credentials or privilege levels to interact with the sensitive endpoint.\nThe attack flow proceeds as follows: an unauthenticated remote attacker crafts a malicious HTTP POST request containing arbitrary shell commands. The attacker transmits this payload over the network to the /api/fs/exec endpoint of an exposed OpenChamber instance. Because the authentication middleware evaluates to a no-op when UI_PASSWORD is absent, the request bypasses access controls entirely and reaches the vulnerable Node.js backend handler.\nUpon receiving the request, the backend function passes the raw input directly to Node.js spawn() without validation or argument isolation. The operating system executes the payload under the security context of the user running the OpenChamber process. Finally, the application captures the resulting stdout, stderr, and exit code, returning the full execution output directly within the HTTP server response to the attacker, facilitating effective post-exploitation reconnaissance and control."
}