CVE-2018-20434

LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $_POST['community'] parameter to html/pages/addhost.inc.php during creation of a new device, and then making a /ajax_output.php?id=capture&format=text&type=snmpwalk&hostname=localhost request that triggers html/includes/output/capture.inc.php command mishandling.

CVSS v3.0 NVD

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

71.49% chance of exploitation in the next 30 days, 99th percentile

Published

2019-04-24

Updated

2024-08-05

Proof-of-concept exploits (4)

• https://gist.github.com/mhaskar/516df57aafd8c6e3a1d70765075d372d
• ayadim/exploitBox9★ · 2019-07-05
• mhaskar/CVE-2018-204349★ · 2019-04-25
• spart9k/INT-180★ · 2023-12-14

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/librenms_addhost_cmd_…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/47044
• https://www.exploit-db.com/exploits/46970

Security advisories

• https://drive.google.com/file/d/1LcGmOY8x-TG-wnNr-cM_f854kxk0etva/view?usp=sharing
• https://shells.systems/librenms-v1-46-remote-code-execution-cve-2018-20434
• advisories/GHSA-62q7-qj6g-gvr7

References

• CVE Record
• NVD entry

Related

• CVE-2019-13024
• CVE-2019-15029
• CVE-2019-16662
• CVE-2019-16663
• CVE-2019-20224
• CVE-2020-12078