Authorization Bypass and RCE in luci-app-lxc

The OpenWrt luci-app-lxc package contains a critical ACL inconsistency vulnerability that permits authenticated, low-privileged users to bypass authorization controls. This flaw specifically affects backend container management routes. By exploiting a path traversal vulnerability triggered via the lxc_name parameter, an attacker can escape the intended container isolation boundaries.

The exploit utilizes the /.%2E sequence to traverse directories and gain access to host-level configurations. Once access is achieved, an attacker can manipulate host-side scripts, specifically those defined in lxc.hook.start-host. Successful exploitation results in arbitrary code execution with root privileges on the underlying OpenWrt host. This vulnerability has been assigned a CVSS v3.1 base score of 9.9, highlighting the severe risk to network infrastructure running affected OpenWrt firmware versions.

Attack Chain

1. Attacker authenticates to the LuCI web interface with low-privileged credentials.
2. Attacker crafts a malicious request targeting backend container management routes.
3. Attacker injects a path traversal payload /.%2E into the lxc_name parameter.
4. The application fails to validate the input, allowing the attacker to escape the container directory structure.
5. Attacker locates the lxc.hook.start-host configuration file on the host filesystem.
6. Attacker overwrites or modifies the hook script to include arbitrary malicious commands.
7. The system triggers the hook script during a container start event.
8. The host executes the attacker-controlled script with root privileges, resulting in full system compromise.

Impact

Successful exploitation of this vulnerability grants an attacker full root access to the OpenWrt host, which typically serves as the edge gateway or router. An attacker could intercept network traffic, modify firewall rules, establish persistent backdoor access, or use the device as a pivot point into the internal network. Given the typical placement of OpenWrt devices at the network perimeter, this represents a significant risk to the entire organizational infrastructure.

Recommendation

• Update OpenWrt firmware to the latest version, ensuring the luci-app-lxc package is patched to the version addressing CVE-2026-72842.
• Restrict access to the LuCI web management interface to trusted internal management subnets via the host firewall (e.g., iptables or nftables rules).
• Audit logs for unauthorized access attempts to the container management backend routes.
• Disable the luci-app-lxc package if container management is not required on the device.