AES-CTR vulnerability to cryptographic oracle
In general, CTR mode is not secure against chosen-ciphertext attacks.  (The same goes for the other classic block cipher modes of operation too; to get security against chosen-ciphertext attacks, you need authenticated encryption.)

In your stated attack scenario, the attacker can obviously use the decryption oracle to decrypt any ciphertexts they intercept, which (assuming there are indeed no limitations on the attacker's access to the decryption oracle) is as good as having the key.  Since this is kind of a boring scenario (the attacker always wins and there's nothing we can do about it), I'll assume that there are at least some messages that the attacker would like to decrypt, but for which they cannot directly query the decryption oracle.

For example, the attacker might only have access to the decryption oracle up to some time limit ("lunchtime attack"), but would like to decrypt messages intercepted after this time limit.  Unfortunately, with CTR mode (or any synchronous stream cipher), the attacker can still do this if they can predict (with reasonable accuracy) the nonces used for future messages: for each likely future nonce, they can ask for the decryption of a message consisting of a long sequence of null bytes using that nonce.  This will give them the raw keystream corresponding to that nonce, which they can then save for later, allowing them to decrypt any future message encrypted using that nonce.

Making the nonces unpredictable thwarts this particular attack, but still does not provide full IND-CCA2 security since the cipher remains malleable.  To make CTR mode non-malleable, you'll need to combine it with a message authentication code using the encrypt-then-MAC construction (i.e. first encrypt the message using CTR mode, then calculate the MAC for the IV + ciphertext).

Note that including the IV in the MAC calculation is essential; if you don't, the attacker can just intercept any legitimate message, change its IV, submit it to the decryption oracle and XOR the returned plaintext with the ciphertext to get the keystream for that IV.