Executive brief
9router, a tool for managing network routing and tunnels, contains a security flaw that allows unauthorized individuals to execute arbitrary commands on the host system. By sending a specially crafted request to a specific web address used for installing Tailscale, an attacker can bypass security checks and take full control of the server. This is particularly dangerous for deployments running as the 'root' user, such as certain Docker configurations, as it could lead to a complete system compromise and data theft.
Technical details
The vulnerability consists of two parts: a missing authorization check in the Next.js middleware matcher and an OS command injection in the Tailscale installation routine. The `/api/tunnel/tailscale-install` route is omitted from the `dashboardGuard` middleware, allowing unauthenticated POST requests. The handler for this route accepts a `sudoPassword` from the JSON body and pipes it directly into a `sudo -S sh` child process. In environments where the Node process runs as root or has `NOPASSWD` sudo privileges, the shell interprets the attacker-supplied password string as a command before executing the legitimate installation script. This allows for full remote code execution as the user running the 9router process. The issue is fixed in version 0.4.45.
Affected products
- decolua 9router < 0.4.45
Timeline
- 2026-05-29: disclosed
- 2026-07-02: advisory