PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

LibreNMS Authenticated RCE (< 26.5.0)

projectblack.io | research | #rce | #web-security | #command-injection | #librenms | #authenticated
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

The second LibreNMS post: an unsanitised exec call in the Libvirt discovery module allows authenticated RCE, plus alternative paths via writable binaries and composer wrapper argument injection.
Published
Collected

Related coverage

research · projectblack.io
LibreNMS < 26.3.0 Authenticated RCE & XSS
Searching for unsafe patterns revealed authenticated XSS and RCE in LibreNMS before 26.3.0, including an arbitrary file write path and abuse of configurable binary locations to run code.
vulnerability · vercel.com
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.
vulnerability · vercel.com
Our $1 million hacker challenge for React2Shell
We paid $1M to security researchers to break our WAF. Here's what we learned defending against React2Shell.
research · portswigger.net
Drag and Pwnd: Leverage ASCII characters to exploit VS Code
Control characters like SOH and carriage return, forwarded blindly by node-pty, enable command injection through VS Code run configurations and filenames dropped into terminals on macOS and Ubuntu.
research · swarm.ptsecurity.com
Cisco Hyperflex: How We Got RCE Through Login Form and Other Findings
An assessment of Cisco HyperFlex HX that found three vulnerabilities: command injection in the installer VM (CVE-2021-1497, CVSS 9.8) and the data platform (CVE-2021-1498), plus a file upload flaw (CVE-2021-1499) — including RCE reached through the login form.
research · swarm.ptsecurity.com
Swarm of Palo Alto PAN-OS vulnerabilities
Analysis of four Palo Alto PAN-OS firewall vulnerabilities: authenticated command injection (CVE-2020-2037, CVE-2020-2038), unauthenticated denial of service (CVE-2020-2039) and reflected XSS (CVE-2020-2036) — each able to leak data, disrupt components or expose internal segments.
Back