From: Jo-Philipp Wich <redacted>
Date: Thu, 11 Jun 2026 08:10:34 +0000 (+0200)
Subject: luci-app-tailscale-community: fix shell code injections through login params
X-Git-Url: http://git.99rst.org/?a=commitdiff_plain;h=507ab5e45c304543d4111af9a331db0f03be6bcb;p=openwrt-luci.git

luci-app-tailscale-community: fix shell code injections through login params

While individual user supplied credential values were properly shell quoted,
the entire constructed command line got passed to `/bin/sh -c "..."`, enabling
interpolation of nested `$(...)` and backtick expressions.

Solve the issue by passing the final command string as properly escaped,
single quoted expression to the shell.

A more thorough fix would be using `system([...])` with an array vector
but since I neither can test, nor understand the reason for the shell
`&` background operation, I cannot easily fix this.

See https://github.com/openwrt/luci/security/advisories/GHSA-xwc5-mx58-rh35.

Signed-off-by: Jo-Philipp Wich <redacted>
---

diff --git a/applications/luci-app-tailscale-community/root/usr/share/rpcd/ucode/tailscale.uc b/applications/luci-app-tailscale-community/root/usr/share/rpcd/ucode/tailscale.uc
index 8e2b7aa56a..b7bf94b0ba 100755
--- a/applications/luci-app-tailscale-community/root/usr/share/rpcd/ucode/tailscale.uc
+++ b/applications/luci-app-tailscale-community/root/usr/share/rpcd/ucode/tailscale.uc
@@ -161,7 +161,7 @@ methods.do_login = {
 
 		// Run the command in the background using /bin/sh -c to handle the '&' correctly
 		let login_cmd = 'tailscale login '+join(' ', loginargs);
-		popen('/bin/sh -c "' + login_cmd + ' &"', 'r');
+		popen('/bin/sh -c ' + shell_quote(login_cmd + ' &'), 'r');
 
 		// --- 2. Loop to Check Status for URL ---
 		let max_attempts = 15;