Fedora 44 Domoticz 2026.3 Security Update: Web Server and API Fixes Require Immediate Patching

---
title: Domoticz Process Spawning Shell or Script Interpreter
id: 9c2e4b71-5f8a-4d3e-b6c1-7a9f0e2d5b84
status: experimental
description: Detects the domoticz service process spawning shells, script interpreters, or download utilities — a strong indicator of web server/API exploitation or abuse of Domoticz script-execution features by an attacker.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-44-domoticz-2026-471f1abb1f
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.exploitation_of_public_facing_application
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/domoticz'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate Domoticz automation scripts configured by the administrator (review CommandLine; known-good script paths can be allowlisted)
level: high
---
title: Domoticz Web API Probing and Enumeration
id: 3f7a1c58-2b9d-4e6f-a1c3-8d5e0b4a7f29
status: experimental
description: Detects scanning or enumeration behavior against the Domoticz web interface and JSON API, including access to sensitive device/command endpoints from external or unusual sources.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-44-domoticz-2026-471f1abb1f
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1595/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.reconnaissance
  - attack.t1595
  - attack.exploitation_of_public_facing_application
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/json.htm'
      - '/api/'
  selection_query:
    cs-uri-query|contains:
      - 'type=command'
      - 'type=devices'
      - 'type=users'
      - 'type=camera'
  filter_local:
    c-ip|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
      - '127.'
  condition: selection_uri and selection_query and not filter_local
falsepositives:
  - Remote administration over VPN (allowlist VPN egress addresses)
  - Legitimate cloud/mobile app integrations
level: medium
---
title: Domoticz Listening on Internet-Facing Interface
id: 6b1d8e44-7c2a-4f5b-9e3d-0a8c6f1e4d72
status: experimental
description: Identifies the Domoticz web server bound to non-loopback interfaces, indicating potential network exposure of a component receiving important security fixes.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-44-domoticz-2026-471f1abb1f
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exploitation_of_public_facing_application
  - attack.t1190
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith: '/domoticz'
    DestinationPort:
      - 8080
      - 443
      - 6144
  filter_loopback:
    DestinationIp|startswith:
      - '127.'
      - '::1'
  condition: selection and not filter_loopback
falsepositives:
  - Intended LAN access to the home automation dashboard
level: low

// Hunt for Domoticz exploitation indicators in Microsoft Sentinel
// Requires Syslog/CEF ingestion from Linux hosts (e.g., via auditd, osquery, or Sysmon for Linux)

// Part 1: Domoticz process spawning suspicious child processes
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName =~ "domoticz" or SyslogMessage has "domoticz"
| where SyslogMessage has_any ("/bin/bash", "/bin/sh", "/bin/dash", "python3", "/usr/bin/perl", "/usr/bin/curl", "/usr/bin/wget", "/bin/nc ", "ncat", "socat")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
| order by TimeGenerated desc
;

// Part 2: External IPs reaching the Domoticz web/API port (ingested via firewall/netflow CEF logs)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort in (8080, 6144)
| where not (SourceIP startswith "10." or SourceIP startswith "192.168." or SourceIP startswith "172.16.")
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by SourceIP, DestinationIP, DestinationPort
| order by ConnectionCount desc
;

// Part 3: API endpoint probing against json.htm with sensitive command types
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has "json.htm"
| where RequestURL has_any ("type=command", "type=users", "type=devices", "type=camera")
| summarize Requests = count(), UniqueURIs = dcount(RequestURL)
    by SourceIP, DestinationIP
| where Requests > 20
| order by Requests desc

-- Velociraptor artifact: audit Domoticz host for compromise indicators
-- Scope: process tree, listening sockets, suspicious files near Domoticz dirs, and recent service changes

-- Part 1: Is domoticz running, and what are its children?
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'domoticz'
   OR CommandLine =~ 'domoticz'

-- Part 2: Identify the domoticz PID's child processes (re-run scoped per host after Part 1)
SELECT Pid, Ppid, Name, CommandLine, Exe, CreateTime
FROM pslist()
WHERE Exe =~ '(bash|sh|dash|python|perl|curl|wget|nc|ncat|socat)$'

-- Part 3: Confirm network exposure of the web server
SELECT Pid, Name, Status, Laddr, Raddr
FROM netstat()
WHERE Name =~ 'domoticz'
   OR Laddr =~ ':8080'

-- Part 4: Look for dropped files or web shells in/near Domoticz web root and scripts
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  '/opt/domoticz/www/**/*.php',
  '/opt/domoticz/www/**/*.sh',
  '/usr/share/domoticz/www/**/*.sh',
  '/opt/domoticz/scripts/**'
])
ORDER BY Mtime DESC

-- Part 5: Verify installed package version (Fedora/RPM)
SELECT * FROM execve(argv=['rpm', '-q', 'domoticz', '--queryformat', '%{VERSION}
'])

#!/bin/bash
# Domoticz 2026.3 security patch verification & exposure audit (Fedora 44)
# Run as root or via sudo on the Domoticz host.

echo "=== [1] Current domoticz package version ==="
INSTALLED=$(rpm -q --queryformat '%{VERSION}' domoticz 2>/dev/null)
echo "Installed version: ${INSTALLED:-NOT INSTALLED}"
if [ "$INSTALLED" == "2026.3" ]; then
  echo "[OK] Patched version 2026.3 present."
else
  echo "[ACTION REQUIRED] Version is not 2026.3 — apply update now:"
  echo "    sudo dnf upgrade --refresh --advisory FEDORA-2026-471f1abb1f"
fi

echo ""
echo "=== [2] Web server exposure check (listening interfaces) ==="
ss -lntp | grep -Ei 'domoticz|:8080|:6144' || echo "No domoticz listener found."

echo ""
echo "=== [3] Domoticz process child-process audit (should be empty) ==="
DOM_PID=$(pgrep -x domoticz | head -1)
if [ -n "$DOM_PID" ]; then
  ps --ppid "$DOM_PID" -o pid,comm,args
else
  echo "domoticz service not currently running."
fi

echo ""
echo "=== [4] Recent file modifications in web root (potential dropped payloads) ==="
find /opt/domoticz/www /usr/share/domoticz/www -type f -mtime -14 2>/dev/null | head -50

echo ""
echo "=== [5] Firewall check: is 8080 reachable from untrusted zones? ==="
firewall-cmd --list-all 2>/dev/null | grep -Ei '8080|domoticz' || echo "No explicit 8080 rule found — verify zone defaults."

echo ""
echo "=== [6] Restart service after patching ==="
echo "    sudo systemctl restart domoticz"