GHSA-jf24-8g2h-2wg7: LibreNMS Vulnerable to Remote Code Execution via AboutController

Remote Code Execution via AboutController in LibreNMS Summary A Remote Code Execution (RCE) vulnerability exists in LibreNMS 26.3.1 through the AboutController. An authenticated administrator can manipulate the snmpget configuration parameter to execute arbitrary system commands. When the /about endpoint is accessed, the application executes the configured binary path via shell_exec() without proper validation. This vulnerability leads to complete server compromise, allowing attackers to establish reverse shells, exfiltrate sensitive data, and maintain persistent access. Severity: High (CVSS 7.2) Attack Vector: Network Privileges Required: High (Administrator) User Interaction: None Impact: Complete system compromise with web server privileges Details Vulnerable Code File: app/Http/Controllers/AboutController.php Line: 85 'version_netsnmp' => str_replace('version: ', '', rtrim(shell_exec(LibrenmsConfig::get('snmpget', 'snmpget') . ' -V 2>&1'))), Root Cause The AboutController retrieves the snmpget configuration value from the database and directly concatenates it into a shell_exec() call without proper validation or escaping. While the sanitizePath() function attempts to validate executable paths by blocking special characters (;, , #, $, |, &, ', ", >, <, (`), it only prevents direct command injection. It does NOT prevent an attacker from pointing the configuration to a malicious executable file already present on the system. Configuration Access The snmpget configuration can be modified through the web interface: - Endpoint: PUT /settings/snmpget - Controller: SettingsController::update() - Required Privileges: Administrator - Config Definition: resources/definitions/config_definitions.json "snmpget": { "default": "/usr/bin/snmpget", "type": "executable" } Validation Analysis The sanitizePath() function in DynamicConfigItem.php: // LibreNMS/Util/DynamicConfigItem.php:277-284 private function sanitizePath(string $path): string|false { if (preg_match