GHSA-jf24-8g2h-2wg7

# Remote Code Execution via AboutController in LibreNMS ## Summary A Remote Code Execution (RCE) vulnerability exists in LibreNMS 26.3.1 through the AboutController. An authenticated administrator can manipulate the `snmpget` configuration parameter to execute arbitrary system commands. When the `/about` endpoint is accessed, the application executes the configured binary path via `shell_exec()` without proper validation. This vulnerability leads to complete server compromise, allowing attackers to establish reverse shells, exfiltrate sensitive data, and maintain persistent access. **Severity:** High (CVSS 7.2) **Attack Vector:** Network **Privileges Required:** High (Administrator) **User Interaction:** None **Impact:** Complete system compromise with web server privileges --- ## Details ### Vulnerable Code **File:** `app/Http/Controllers/AboutController.php` **Line:** 85 ```php 'version_netsnmp' => str_replace('version: ', '', rtrim(shell_exec(LibrenmsConfig::get('snmpget', 'snmpget') . ' -V 2>&1'))), ``` ### Root Cause The AboutController retrieves the `snmpget` configuration value from the database and directly concatenates it into a `shell_exec()` call without proper validation or escaping. While the `sanitizePath()` function attempts to validate executable paths by blocking special characters (`;`, `` ` ``, `#`, `$`, `|`, `&`, `'`, `"`, `>`, `<`, `(`), it only prevents direct command injection. It does NOT prevent an attacker from pointing the configuration to a malicious executable file already present on the system. ### Configuration Access The `snmpget` configuration can be modified through the web interface: - **Endpoint:** `PUT /settings/snmpget` - **Controller:** `SettingsController::update()` - **Required Privileges:** Administrator - **Config Definition:** `resources/definitions/config_definitions.json` ```json "snmpget": { "default": "/usr/bin/snmpget", "type": "executable" } ``` ### Validation Analysis The `sanitizePath()