Description

luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into /etc/crontabs/root as though it were one logical line. An authenticated delegated user with the luci-app-adblock-fast write ACL can therefore create an additional physical root cron entry through applications/luci-app-adblock-fast/root/usr/share/rpcd/ucode/luci.adblock-fast, resulting in persistent command execution as UID 0 when cron runs. The issue is not demonstrated for unauthenticated callers or users without the component write ACL. This vulnerability is fixed in 1.2.4-2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-21T20:17:26.500Z",
  "pubdate": "2026-09-21T20:17:26.500Z",
  "executiveSummary": "A command injection vulnerability exists within the luci-app-adblock-fast package for OpenWrt, specifically within the luci.adblock-fast.setCronEntry RPC method prior to version 1.2.4-2. The flaw stems from insufficient input sanitization of the entry argument, which allows an attacker to inject carriage-return or line-feed characters.\nThis vulnerability enables an authenticated user possessing the luci-app-adblock-fast write ACL to perform privilege escalation. By injecting newline characters, an attacker can manipulate the structure of the /etc/crontabs/root file, effectively appending arbitrary cron jobs that execute with UID 0 (root) privileges when the cron daemon processes the file.\nThe risk is categorized as critical for environments where administrative or delegated users are untrusted, as it provides a persistent mechanism for root-level command execution. Exploitation requires authenticated access with specific write permissions, meaning it cannot be triggered by unauthenticated remote attackers. The issue is resolved in version 1.2.4-2 by implementing proper input validation to strip or reject illegal control characters.",
  "technicalDetails": "The vulnerability resides in the ucode-based RPC implementation located at /usr/share/rpcd/ucode/luci.adblock-fast. The function luci.adblock-fast.setCronEntry is responsible for managing cron job configurations for the adblock-fast service by interacting with the system's crontab file, specifically /etc/crontabs/root.\nThe root cause is an improper neutralization of special characters during the processing of user-supplied input. Specifically, the RPC method fails to validate the entry argument for the presence of newline characters (\\n) or carriage returns (\\r). Because the system serializes this argument directly into the target crontab file, an attacker can manipulate the crontab's syntax.\nThe exploitation flow proceeds as follows: 1) An attacker with authenticated access and the required write ACL initiates a call to the luci.adblock-fast.setCronEntry method. 2) The attacker crafts a malicious payload for the entry parameter that includes line breaks followed by a new, arbitrary command string (e.g., 'dummy_entry\\n* * * * * /bin/malicious_script.sh'). 3) The RPC component processes this string and writes it to /etc/crontabs/root. 4) The system perceives the malicious portion of the payload as a new, legitimate cron entry due to the injected line breaks.\nOnce the crontab is updated, the cron daemon automatically executes the injected payload at the scheduled interval with root privileges (UID 0). This effectively provides the attacker with full control over the underlying OpenWrt system. Since cron jobs persist across reboots, this vulnerability serves as a highly reliable mechanism for achieving persistent unauthorized code execution.\nAffected versions include all releases of luci-app-adblock-fast prior to 1.2.4-2. The vulnerability is strictly scoped to authenticated sessions with the luci-app-adblock-fast write ACL; unauthenticated callers or users without sufficient permissions are unable to trigger the RPC method responsible for the file modification. The primary defense against this vector involves strict input filtering to prohibit the injection of control characters, ensuring that the entry argument remains a single, well-defined logical line within the configuration file."
}