CVE-2024-51092

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's initRrdDirectory().

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's initRrdDirectory().

Summary

An authenticated attacker can create dangerous directory names on the system and alter sensitive configuration parameters through the web portal. Those two defects combined then allows to inject arbitrary OS commands inside shell_exec() calls, thus achieving arbitrary code execution.

Details

OS Command Injection

We start by inspecting the file app/Http/Controllers/AboutController.php, more particularly the index() method which is executed upon simply visiting the /about page:

public function index(Request $request)
    {
        $version = Version::get();

        return view('about.index', [
            <TRUNCATED>

            'version_webserver' => $request->server('SERVER_SOFTWARE'),
            'version_rrdtool' => Rrd::version(),
            'version_netsnmp' => str_replace('version: ', '', rtrim(shell_exec(Config::get('snmpget', 'snmpget') . ' -V 2>&1'))),

           <TRUNCATED>
        ]);
    }

We can see that the version_netsnmp key receives a value direclty dependent of a shell_exec() call. The argument to this call reflects a configuration parameter with no sanitization. Should an attacker identify a way to alter this parameter, the server is at risk of being compromised.

Configuration parameters poisoning

We now focus on the update() method of the SettingsController.php script. This method is called when the user visits the route /settings/{key} via HTTP PUT. The key parameter here is simply the name of the configuration key the user wishes to modify.

public function update(DynamicConfig $config, Request $request, $id)
{
    $value = $request->get('value');

    if (! $config->isValidSetting($id)) {
        return $this->jsonResponse($id, ':id is not a valid setting', null, 400);
    }

    $current = \LibreNMS\Config::get($id);
    $config_item = $config->get($id);

    if (! $config_item->checkValue($value)) {
        return $this->jsonResponse($id, $config_item->getValidationMessage($value), $current, 400);
    }

    if (\LibreNMS\Config::persist($id, $value)) {
        return $this->jsonResponse($id, "Successfully set $id", $value);
    }

    return $this->jsonResponse($id, 'Failed to update :id', $current, 400);
}

We can see that some protections are implemented around the configuration parameters by $config_item->checkValue($value), with a format of data being expected depending on the data type of the variable the user wants to modify. Specifically, the snmpget configuration variable expects a valid path to an existing binary on the system. To summarize : if an attacker finds a valid full-path to a system binary, while that full-path also holds shell metacharacters, then those characters would be interpreted by the shell_exec() call defined above and allow for arbitrary command execution.

Arbitrary directory creation

When creating a new Device through the "Add Device" page, the server allows the user to send malformed or impossible hostnames and force the data to be stored, with no sanitization being performed on this field.

In the file app/Jobs/PollDevice.php, the initRrdDirectory() method is responsible for creating a directory named after the Device's hostname. We can see the mkdir() call inside the try block:

private function initRrdDirectory(): void
{
    $host_rrd = \Rrd::name($this->device->hostname, '', '');
    if (Config::get('rrd.enable', true) && ! is_dir($host_rrd)) {
        try {
            mkdir($host_rrd);
            Log::info("Created directory : $host_rrd");
        } catch (\ErrorException $e) {
            Eventlog::log("Failed to create rrd directory: $host_rrd", $this->device);
            Log::info($e);
        }
    }
}

This method is called by initDevice(), which is itself called by the handle() method (executed when the job starts). \Rrd::name() simply concatenates a string following the format <LIBRENMS_INSTALL_DIR>/rrd/<DEVICE_HOSTNAME>.

Summary

With all this, an…

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's initRrdDirectory().

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's initRrdDirectory().

Summary

An authenticated attacker can create dangerous directory names on the system and alter sensitive configuration parameters through the web portal. Those two defects combined then allows to inject arbitrary OS commands inside shell_exec() calls, thus achieving arbitrary code execution.

Details

OS Command Injection

We start by inspecting the file app/Http/Controllers/AboutController.php, more particularly the index() method which is executed upon simply visiting the /about page:

public function index(Request $request)
    {
        $version = Version::get();

        return view('about.index', [
            <TRUNCATED>

            'version_webserver' => $request->server('SERVER_SOFTWARE'),
            'version_rrdtool' => Rrd::version(),
            'version_netsnmp' => str_replace('version: ', '', rtrim(shell_exec(Config::get('snmpget', 'snmpget') . ' -V 2>&1'))),

           <TRUNCATED>
        ]);
    }

We can see that the version_netsnmp key receives a value direclty dependent of a shell_exec() call. The argument to this call reflects a configuration parameter with no sanitization. Should an attacker identify a way to alter this parameter, the server is at risk of being compromised.

Configuration parameters poisoning

We now focus on the update() method of the SettingsController.php script. This method is called when the user visits the route /settings/{key} via HTTP PUT. The key parameter here is simply the name of the configuration key the user wishes to modify.

public function update(DynamicConfig $config, Request $request, $id)
{
    $value = $request->get('value');

    if (! $config->isValidSetting($id)) {
        return $this->jsonResponse($id, ':id is not a valid setting', null, 400);
    }

    $current = \LibreNMS\Config::get($id);
    $config_item = $config->get($id);

    if (! $config_item->checkValue($value)) {
        return $this->jsonResponse($id, $config_item->getValidationMessage($value), $current, 400);
    }

    if (\LibreNMS\Config::persist($id, $value)) {
        return $this->jsonResponse($id, "Successfully set $id", $value);
    }

    return $this->jsonResponse($id, 'Failed to update :id', $current, 400);
}

We can see that some protections are implemented around the configuration parameters by $config_item->checkValue($value), with a format of data being expected depending on the data type of the variable the user wants to modify. Specifically, the snmpget configuration variable expects a valid path to an existing binary on the system. To summarize : if an attacker finds a valid full-path to a system binary, while that full-path also holds shell metacharacters, then those characters would be interpreted by the shell_exec() call defined above and allow for arbitrary command execution.

Arbitrary directory creation

When creating a new Device through the "Add Device" page, the server allows the user to send malformed or impossible hostnames and force the data to be stored, with no sanitization being performed on this field.

In the file app/Jobs/PollDevice.php, the initRrdDirectory() method is responsible for creating a directory named after the Device's hostname. We can see the mkdir() call inside the try block:

private function initRrdDirectory(): void
{
    $host_rrd = \Rrd::name($this->device->hostname, '', '');
    if (Config::get('rrd.enable', true) && ! is_dir($host_rrd)) {
        try {
            mkdir($host_rrd);
            Log::info("Created directory : $host_rrd");
        } catch (\ErrorException $e) {
            Eventlog::log("Failed to create rrd directory: $host_rrd", $this->device);
            Log::info($e);
        }
    }
}

This method is called by initDevice(), which is itself called by the handle() method (executed when the job starts). \Rrd::name() simply concatenates a string following the format <LIBRENMS_INSTALL_DIR>/rrd/<DEVICE_HOSTNAME>.

Summary

With all this, an…