LibreNMS has an Authenticated OS Command Injection
Date: 2024-11
Affected: composer/librenms/librenms
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2024-51092
CWE: CWE-78
CVSS: 9.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L)

### Summary An authenticated attacker can create dangerous directory names on the system and alter sensitive configuration parameters through the web portal. Those two defects combined then allows to inject arbitrary OS commands inside `shell_exec()` calls, thus achieving arbitrary code execution. ### Details #### OS Command Injection We start by inspecting the file `app/Http/Controllers/AboutController.php`, more particularly the index() method which is executed upon simply visiting the /about page: ```php public function index(Request $request) { $version = Version::get(); return view('about.index', [ <TRUNCATED> 'version_webserver' => $request->server('SERVER_SOFTWARE'), 'version_rrdtool' => Rrd::version(), 'version_netsnmp' => str_replace('version: ', '', rtrim(shell_exec(Config::get('snmpget', 'snmpget') . ' -V 2>&1'))), <TRUNCATED> ]); } ``` We can see that the `version_netsnmp` key receives a value direclty dependent of a `shell_exec()` call. The argument to this call reflects a configuration parameter with no sanitization. Should an attacker identify a way to alter this parameter, the server is at risk of being compromised. #### Configuration parameters poisoning We now focus on the `update()` method of the `SettingsController.php` script. This method is called when the user visits the route `/settings/{key}` via HTTP PUT. The key parameter here is simply the name of the c


Mitigations:

Architectural layers (MAESTRO):