UniFi OS Server Critical RCE Chain Lets Attackers Gain Root Access Without Credentials

Key Takeaways

• A critical unauthenticated remote code execution (RCE) vulnerability chain has been discovered in UniFi OS Server software.
• Attackers can achieve full root access on affected devices with a single unauthenticated request, bypassing authentication and exploiting command injection.
• The vulnerabilities affect UniFi OS Server versions prior to 3.2.12.
• Ubiquiti released UniFi OS Server 3.2.12 on May 13, 2025, to address these issues. Immediate patching and post-patch credential rotation are strongly recommended.

A severe chain of vulnerabilities within UniFi OS Server software has been uncovered, posing a significant risk to numerous organizations utilizing Ubiquiti’s UniFi ecosystem. Security researchers at BishopFox have demonstrated that this flaw allows an attacker to gain complete root access to vulnerable systems without needing any authentication credentials, simply by sending a single unauthenticated request. This effectively enables a full system takeover.

UniFi OS Server functions as the central management platform for various UniFi applications, including Network and Protect, alongside essential identity and update services. Its architecture relies on a collection of backend services managed by a single Nginx frontend. This frontend is responsible for TLS termination, authenticating incoming requests, and then forwarding them to the appropriate internal services. Crucially, this Nginx proxy acts as the primary security gate, and it is precisely where this potent attack chain originates.

BishopFox researchers meticulously identified and confirmed the entire attack sequence, proving that a single, specially crafted request to an exposed UniFi OS Server can result in a reverse shell with full root privileges. In a report shared with Cyber Security News (CSN), BishopFox emphasized the extreme severity of this vulnerability, noting that the compromised appliance controls the entire network it manages. Achieving root access means an attacker can exfiltrate all stored secrets, create persistent administrative sessions that survive patching, and in physical deployments, even compromise access controls and security cameras.

On May 13, 2025, Ubiquiti issued Security Advisory Bulletin SAB-013, detailing five vulnerabilities across the UniFi OS device family that collectively enable unauthenticated remote code execution. Three of these vulnerabilities are particularly critical, each assigned a CVSS score of 10.0:

• An improper access control flaw in the authentication gateway.
• A path traversal flaw, also in the authentication gateway.
• An improper input validation flaw within the package-update service.

Exploitation only requires access to the UniFi OS Server’s administrative interface, which typically listens on TCP port 443. This makes the vulnerability reachable from any location where the web management panel is accessible.

UniFi OS Server Critical RCE Chain

The attack chain is composed of three distinct stages:

Part One: Authentication Gateway Bypass

The initial step involves bypassing the Nginx authentication gateway. Nginx utilizes an auth_request subrequest to the unifi-core Node service to determine if a request is public or requires authentication. The core issue stems from a discrepancy in how URIs are interpreted: the public-exemption check operates on the raw, percent-encoded x-original-uri header, while Nginx routes the request using its normalized, decoded URI. By crafting a request where the raw form begins with the authentication-exempt /api/auth/validate-sso/ prefix, but its normalized form resolves to an internal /proxy/ route, an attacker can circumvent the gateway without providing any credentials.

Part Two: Command Injection Sink

Once past the gateway, the attack targets a package-update route within the shared identity and update backend. The handler for this route constructs a command string using fmt.Sprintf, incorporating a caller-supplied package name into a format like sudo /usr/bin/ uos runnable latest-versions %v. In UniFi OS Server version 3.1.16, there was no validation for this package name. The resulting string is then passed to a helper function that executes it via a sh -c shell wrapper. This lack of validation allows shell metacharacters in the input to be interpreted as commands rather than literal data, enabling arbitrary command injection.

Part Three: Privilege Escalation to Root

The injected command initially runs under the ucs-update service account, not directly as root. However, this account possesses passwordless sudo entitlements for specific commands, including /usr/bin/dpkg, /bin/chmod, /bin/systemctl, and /usr/bin/uos. BishopFox leveraged the dpkg path on a live system by installing a specially crafted .deb package. The package’s post-installation script was designed to read /etc/shadow, successfully confirming full root execution capabilities.

What You Should Do

• Immediate Patching: Update UniFi OS Server to version 3.2.12 or later without delay. This update addresses all three components of the RCE chain.
• Credential Rotation: After patching, it is imperative to rotate the JWT signing key, force-logout all active sessions, and reset all database credentials. Since no login attempts are logged during exploitation, there is no trail to indicate compromise.
• Network Segmentation: Restrict external access to the UniFi OS Server web interface. Limit access to a dedicated management network to prevent unauthenticated requests from reaching the gateway from the broader internet.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.