This endpoint is reachable by anonymous users if the instance has requireLogin=false or during the initial bootstrap phase before a management password is set. Because the endpoint lacks necessary restrictions defined in the LOCAL_ONLY_API_PREFIXES or SPAWN_CAPABLE_PREFIXES policies, the request bypasses authorization checks. An attacker can use this vulnerability to achieve full command execution within the context of the OmniRoute server container.

Attack Chain

1. Attacker identifies a target OmniRoute instance where requireLogin is set to false, or targets a new instance during its initial setup window.
2. Attacker sends an unauthenticated POST request to the /api/acp/agents endpoint.
3. The request body contains malicious binary (e.g., "node") and versionCommand fields, where the latter includes an -e argument followed by arbitrary JavaScript code.
4. The OmniRoute application saves the agent definition without verifying the safety of the versionCommand content beyond a simple token consistency check.
5. The application automatically triggers refreshAgentCache(), which invokes detectInstalledAgents() to probe the new agent.
6. The detectAgent() function calls execFileSync to execute the attacker-provided versionCommand string.
7. The Node.js process executes the injected JavaScript, allowing the attacker to interact with the underlying OS via child_process.execSync().

Impact

Successful exploitation allows for unauthenticated remote code execution within the OmniRoute server container. This grants an attacker the ability to execute system commands, access environment variables, manipulate local data files (such as database backups or configuration files), and potentially move laterally within the containerized environment. This vulnerability affects all OmniRoute instances running versions 3.8.50 and earlier.

Recommendation

Prioritized actions for detection and remediation:

• Immediately upgrade all OmniRoute instances to a version later than 3.8.50.
• Enable requireLogin=true and enforce strong management authentication to prevent unauthenticated access to administrative API endpoints.
• Deploy the Sigma rules below to monitor for unauthorized requests to the ACP agent registration endpoint.
• Monitor webserver logs for POST requests to /api/acp/agents originating from external or untrusted network segments.