Executive brief
LibreNMS is a network management platform that monitors and manages devices across networks. A flaw in version 1.65 allows authenticated users with normal privileges to execute arbitrary shell commands through the /graph.php API endpoint, potentially giving attackers the ability to compromise the entire monitoring infrastructure and access sensitive network data.
Technical details
This vulnerability is a command injection flaw in the /graph.php API endpoint of LibreNMS 1.65. An authenticated attacker with normal user privileges can inject arbitrary shell commands through unsanitized input parameters. The attack requires network access to the LibreNMS API and valid authentication credentials, but no elevated privileges are needed. Successful exploitation allows remote code execution with the privileges of the LibreNMS application user, enabling full compromise of the monitoring system. The issue was patched in version 1.65.1 (released July 10, 2020), with commits addressing input sanitization in the graph title handling.
Affected products
- LibreNMS LibreNMS 1.65
Timeline
- 2020-07-09: disclosed: Vulnerability identified and fixes prepared
- 2020-07-10: patched: Fixed in LibreNMS 1.65.1 with input sanitization commit 1bb6bd8