OS Command Injection in command-injection (CVE-2024-51092, CVSS 9.1)

Summary

OS command injection in command-injection (CVE-2024-51092). Confidential information can be exposed externally. Exploitable via version_netsnmp.

Original description

The description as published by the source.

Summary

An authenticated attacker can create dangerous directory names on the system and alter sensitive configuration parameters through the web portal. Those two defects combined then allows to inject arbitrary OS commands inside shell_exec() calls, thus achieving arbitrary code execution.

Details

OS Command Injection

We start by inspecting the file app/Http/Controllers/AboutController.php, more particularly the index() method which is executed upon simply visiting the /about page:

public function index(Request $request)
    {
        $version = Version::get();

        return view('about.index', [
            

            'version_webserver' => $request->server('SERVER_SOFTWARE'),
            'version_rrdtool' => Rrd::version(),
            'version_netsnmp' => str_replace('version: ', '', rtrim(shell_exec(Config::get('snmpget', 'snmpget') . ' -V 2>&1'))),

           
        ]);
    }

We can see that the version_netsnmp key receives a value direclty dependent of a shell_exec() call. The argument to this call reflects a configuration parameter with no sanitization. Should an attacker identify a way to alter this parameter, the server is at risk of being compromised.

Configuration parameters poisoning

We now focus on the update() method of the SettingsController.php script. This method is called when the user visits the route /settings/{key} via HTTP PUT. The key parameter here is simply the name of the configuration key the u…

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

There's a vulnerability in older versions of LibreNMS that allows attackers to run malicious code remotely. Specifically, it involves creating unsafe directory names or modifying critical system settings in LibreNMS, leading to potential unauthorized actions. The problem has been fixed in later versions, so updating your software is crucial to prevent exploitation. It is advised for companies to upgrade immediately to avoid these risks.

The vulnerability is due to OS command injection in LibreNMS's AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's initRrdDirectory() methods. Attackers can exploit this by inserting a path containing meta-characters into the snmpget configuration parameter. Versions prior to 24.10.0 are affected, with the issue fixed in 24.10.0. Detecting if your system is vulnerable involves searching for specific log entries or anomalous directory names.

❓ What is the problem

A vulnerability in LibreNMS before version 24.10.0 allowing authenticated OS command injection.

📍 Affected scope

AboutController.php (index), SettingsController.php (update), PollDevice.php (initRrdDirectory).

🔥 Severity

Critical - enables remote code execution.

🔧 How to fix

Upgrade to LibreNMS version 24.10.0 or later.

🛡️ Workaround

No workaround specified; upgrading is recommended.

🔍 Detection

Check for anomalous directory names and suspicious log entries.

Related past incidents Similar incidents extracted from past CVEs

CVE-2021-34527

PrintNightmare vulnerability allowing RCE via Print Spooler service.

CVE-2020-0601

Windows CryptoAPI vulnerability affecting certificate validations.

Heartbleed

OpenSSL vulnerability allowing data leakage from memory.

If this happens at your company Expected impact per business scenario

📌 Web hosting environment

Remote code execution could lead to unauthorized access to servers.

📌 Internal network management

Critical configuration settings could be altered by an attacker, affecting system integrity.

📌 Enterprise application deployment

Exposed system settings could be used to pivot to further internal attacks.

Recommended action

Organizations should immediately update LibreNMS to the latest version to mitigate this vulnerability.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
Audit SBOM/dependencies for affected components.
```
依存マニフェストで影響コンポーネントを特定する。
2
Match against affected range verify
```
Confirm if version satisfies `<= 24.9.1`
```
Step 1 で見つかったバージョンが影響範囲 <= 24.9.1 に該当するか照合。本番で稼働中ならインシデント扱い。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

Affected packages

composer librenms/librenms

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.10.0"}]}]

Packagist librenms/librenms

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.10.0"}]}]

OS Command Injection in command-injection (CVE-2024-51092)

Summary

Original description

Summary

Details

OS Command Injection

Configuration parameters poisoning

AI summary

Related past incidents Similar incidents extracted from past CVEs

If this happens at your company Expected impact per business scenario

Response actions

Affected packages

References