LibreNMS Multiple RCE Vulnerabilities Analysis with PoC (<26.5.0)

Vulnerability Overview LibreNMS contains multiple remote code execution (RCE) vulnerabilities that allow attackers to execute arbitrary commands under specific conditions. Affected Versions LibreNMS < 26.5.0 LibreNMS < 26.4.1 Remediation Upgrade to LibreNMS version 26.5.0 or later. Vulnerability Details 1. RCE via Command-Line Injection (< 26.4.1) Description: This vulnerability allows admin users to inject commands, which are then passed to the function for execution. Trigger Conditions: Through the WebUI's Libvirt module, specifically the "Libvirt Username" and "Libvirt Protocols" fields. Exploitation Method: - Set up a webhook listener. - Inject a command into the "Libvirt Username" and "Libvirt Protocols" fields. - The command executes when the poller runs the discovery job. Exploit Code: 2. (Alternative) RCE via Arbitrary Write (Internal Network Only) Description: By modifying the binary path, an attacker uses to download a malicious PHP file to the directory. Trigger Conditions: The server runs on an internal network, and the attacker can access devices on that network. Exploitation Method: - Create a device named with the OS set to Linux. - Modify the binary path to . - Start an HTTP server on the device serving the malicious PHP file. - Wait for the discovery cron job to execute or manually run the discovery command. Exploitation Steps: 1. Create device with OS set to Linux. 2. Modify the path to . 3. Start an HTTP server to serve . 4. Execute the discovery command. Accessing the Malicious File: 3. RCE via Bypassing (< 26.5.0) Description: By bypassing the function, arbitrary commands can be executed via . Trigger Conditions: Usage of the call within . Exploitation Method: Chain the execution of other executables by modifying the executable path. Exploit Code: Summary LibreNMS contains multiple RCE vulnerabilities that attackers can leverage to execute arbitrary commands. It is recommended to upgrade to the latest version as soon as possible to mitigate these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

LibreNMS Multiple RCE Vulnerabilities Analysis with PoC (<26.5.0)