GHSA-c9fv-cgmm-2wg7: Command Injection
Summary A vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By adding an alert transport entry, an attacker with administrative privileges can execute malicious commands.
Details The vulnerability is caused by an unsafe exec call in deliverAlert function of LibreNMS/Alert/Transport/Signal.php. Escapes for the path of signal-cli and the Recipient field are insufficient to prevent command-line injection.
The composerwrapper.php under scripts is also vulnerable to command injection (unsafe exec calls) by passing the injected command as an argument, and it is accepting arguments passed by deliverAlert.
By chaining these unsafe exec calls, malicious admin user can execute any executables in the server's filesystem.
PoC
1. Under Dashboard -> Alert -> Alert Transports
<img width="282" height="273" alt="image" src="https://github.com/user-attachments/assets/b72f55b0-b782-47d0-b4f7-75f498019345" />
2. Create a new Alert Transport entry. a. Select Signal as Transport type. b. Put ../scripts/composerwrapper.php into Path. c. Put the command to execute under Recipient with ; at the start and the end of string.
<img width="767" height="391" alt="image" src="https://github.com/user-attachments/assets/5e34bfa8-4bd5-40cb-9624-0d40e40ccdc5" />
3. . Click Save Transport, and after the popup closed, click Test Transport button under Action of the created Alert Transport entry.
<img width="172" height="90" alt="image" src="https://github.com/user-attachments/assets/7f83db07-fbf9-4be6-b247-533a6d7b9828" />
4. The command is executed. <img width="532" height="216" alt="image" src="https://github.com/user-attachments/assets/d595b0fe-10cc-4050-b4b9-d290b658689d" />
Impact This vulnerability allows a malicious actor to achieve Remote Code Execution (RCE), potentially leading to complete system compromise, data exfiltration, or lateral movement within the network.
Remediation Advice Escape user inputs, and avoid passing them directly into exec function. (scripts/composerwrapper.php) Avoid setting executable paths directly in web interface. Instead, use a config value, and only allow setting executable paths by command line interface. (LibreNMS/Alert/Transport/Signal.php)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/librenms/librenmsto a version that resolves this vulnerability.Fixed in 26.5.0 - Configuration
Create a new Alert Transport entry under Dashboard -> Alert -> Alert Transports, set Transport type to "Signal", and set the transport Path field to "../scripts/composer_wrapper.php" (avoid setting executable paths directly via the web interface; use a config/CLI-defined value instead).
LibreNMS (Alert Transports → Signal transport) Path = ../scripts/composer_wrapper.php - Configuration
When defining the Signal alert transport, put the command to execute in the Recipient field such that the string begins and ends with ';' (per the described required formatting), and ensure user inputs are escaped and not passed directly into PHP's exec; escape-insufficient fields (signal-cli path and Recipient) are not sufficient to prevent command-line injection—use command-line-interface/config-driven executable paths instead.
LibreNMS (Alert Transports → Signal transport) Recipient = ; <command> ;
Event History
Frequently Asked Questions
Who can exploit this issue?
Systems are exposed when an authenticated user has administrative privileges and can create or modify alert transport entries. The described attack is performed through the Alert Transports interface using the Signal transport type.
What access and configuration changes are required for exploitation?
The attacker needs an authenticated administrator account and the ability to configure a Signal alert transport. Exploitation uses a crafted Path value pointing to ../scripts/composer_wrapper.php and an injected command in the Recipient field.
How can I check for suspicious configuration related to this issue?
Review Signal alert transport configurations for a Path value of ../scripts/composer_wrapper.php or other unexpected values, and inspect Recipient fields for shell metacharacters such as semicolons or command-like content. These entries may indicate an attempted or successful exploitation path.
What can be done if updating immediately is not possible?
Restrict administrative access and prevent untrusted administrators from creating or editing alert transport entries, particularly Signal transports. Review existing Signal transport settings and remove unexpected Path or Recipient values until an updated release can be deployed.