Pre-Auth RCE in UniFi OS — CVE-2026-34909 One Request to Roo...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://catchify.sa/post/pre-auth-rce-unifi-os-one-request-to-root
• Blog Title: Pre-Auth RCE in UniFi OS — CVE-2026-34909: One Request to Root Behind Seven Products ($42,751)
• Suggested Section: Pentesting Web → File Inclusion/Path Traversal and Login Bypass (reverse-proxy canonicalization and authentication-prefix bypass), with cross-references to SQL Injection, Command Injection, JWT Vulnerabilities, and Linux Hardening → Sudo Command Abuse

🎯 Content Summary

Research overview

The post documents four vulnerability reports, represented by three CVE identifiers, affecting the shared UniFi OS web perimeter and the UniFi Talk, UniFi Access, and ulp-go identity services. The findings are CVE-2026-50747, covering two PostgreSQL injection patterns reachable by the lowest UniFi Talk role; CVE-2026-50748, an OS command injection and Linux privilege-escalation chain in UniFi Access; and CVE-2026-34909🔧 Technical Details

Ineffective post-construction SQL formatting: Passing an already assembled SQL string through a formatting function does not sanitize it when the function only escapes arguments associated with placeholders. With PostgreSQL pg-format, values must be supplied through specifiers such as %L or, preferably, parameterized queries. Code that first interpolates attacker-controlled values and then calls pgFormat(completedQuery) without placeholders remains directly injectable. Test every reachable parameter independently using boolean response differences, time delays, and database error behavior.

Stacked SQL injection through manually quoted arrays: An array-to-SQL helper is vulnerable when it surrounds strings with single quotes, joins them with commas, and inserts the resulting fragment into a query without real escaping. An input can close the current quote and parenthesized list, terminate the original state...

🤖 Agent Actions

Updated src/pentesting-web/proxy-waf-protections-bypass.md.

Added:

• Raw $request_uri versus normalized $uri authorization bypasses.
• Prefix-based authentication exemption traversal.
• curl --path-as-is testing examples.
• Service-name regex edge cases.
• Trusted-host bypass via client-controlled forwarded Host metadata.
• Technical review and remediation workflow.
• Cross-references to existing SQL injection, command injection, JWT, and sudo pages.
• Numbered citation to the supplied Catchify research.

Validation passed for whitespace, references, internal links, duplication, and forbidden sources. mdbook build was unavailable because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://catchify.sa/post/pre-auth-rce-unifi-os-one-request-to-root

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web → File Inclusion/Path Traversal and Login Bypass (reverse-proxy canonicalization and authentication-prefix bypass), with cross-references to SQL Injection, Command Injection, JWT Vulnerabilities, and Linux Hardening → Sudo Command Abuse".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0