Netdata vulnerable to command injection
CVE-2023-22496 has a selected CVSS score of 8.1 (high); EIP currently links 1 repository PoC and 2 lab environments.
Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. An attacker with the ability to establish a streaming connection can execute arbitrary commands on the targeted Netdata agent. When an alert is triggered, the function `health_alarm_execute` is called. This function performs different checks and then enqueues a command by calling `spawn_enq_cmd`. This command is populated with several arguments that are not sanitized. One of them is the `registry_hostname` of the node for which the alert is raised. By providing a specially crafted `registry_hostname` as part of the health data that is streamed to a Netdata (parent) agent, an attacker can execute arbitrary commands at the remote host as a side-effect of the raised alert. Note that the commands are executed as the user running the Netdata Agent. This user is usually named `netdata`. The ability to run arbitrary commands may allow an attacker to escalate privileges by escalating other vulnerabilities in the system, as that user. The problem has been fixed in: Netdata agent v1.37 (stable) and Netdata agent v1.36.0-409 (nightly). As a workaround, streaming is not enabled by default. If you have previously enabled this, it can be disabled. Limiting access to the port on the recipient Agent to trusted child connections may mitigate the impact of this vulnerability.
| Product | Source | Version range | Status |
|---|---|---|---|
netdataBrowse netdata / netdata | CVE List | < 1.36.0-409 | affected |
| < 1.37 | affected |
The artifact is a fully functional exploit for CVE-2023-22496, a command injection vulnerability in Netdata Agent. It includes a Python script (exploit.py) that crafts a malicious registry_hostname payload, writes it to a configuration file, restarts a Docker container to load the payload, waits for a health alarm to trigger, and then verifies arbitrary command execution on the target.
No backdoor observed in reviewed code
The supplied evidence is a legitimate proof-of-concept (PoC) for CVE-2023-22496, a command injection vulnerability in Netdata. The Dockerfile builds a known-vulnerable version of Netdata from official source. The README and exploit.py describe and automate the documented vulnerability. No concealed, deceptive, or unrelated harmful behavior was observed. The exploit targets the stated vulnerability and performs no actions beyond demonstrating it.
The artifact contains a Python script (exploit.py) that actively exploits CVE-2023-22496 by injecting a command into a configuration file, restarting a service, and verifying remote code execution. This goes beyond scanning or detection; it performs the full exploit chain to achieve command execution on a target system.
exploit.py:1-227README.md:130-139exploit.py:46-47README.md:118-120exploit.py:55-56README.md:12exploit.py:129-131exploit.py:147-160exploit.py:164-169exploit.py:186-192exploit.py:197-205exploit.py:130-131exploit.py:148-156Dockerfile:45-49This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
A Docker-based environment that builds Netdata Agent v1.36.1 from source and provides a standalone exploit script for CVE-2023-22496, an OS command injection vulnerability. The Dockerfile alone does not create a multi-node streaming lab; the exploit script references an external docker-compose.yaml for a 3-node setup.
Dockerfile:1-120README.md:1-227exploit.py:1-227The README explicitly describes a proof-of-concept for CVE-2023-22496, the Dockerfile builds the vulnerable version, and exploit.py automates the attack against a target container. The purpose is clearly vulnerability research and education.
README.md:1-5exploit.py:1-10Two-stage Dockerfile: builder stage compiles Netdata v1.36.1 from source; runtime stage creates a minimal Ubuntu 22.04 image with the compiled binaries and sets up the netdata user. Exposes port 19999 and runs Netdata as the netdata user.
Dockerfile:1-120Python script that injects a malicious registry_hostname into a config file, restarts the target container, waits for a health alarm, and verifies command execution. It interacts with Docker to manage containers and checks for evidence of successful exploitation.
exploit.py:1-227Provides an overview of CVE-2023-22496, details the vulnerable code, explains the injection bypass, describes the streaming attack chain, and gives step-by-step instructions for building, running, and exploiting the lab environment.
README.md:1-227Supported by supplied evidence
The Dockerfile builds Netdata v1.36.1, which is explicitly stated as vulnerable. The exploit script and README describe the unsanitized registry_hostname leading to OS command injection, matching the CVE description.
Dockerfile:1-5README.md:1-5exploit.py:1-10README.md:107-108README.md:109README.md:111exploit.py:100-108README.md:115-120README.md:113-118README.md:120-122README.md:130-135README.md:137-139All visible behavior is directed at the lab's own target container (agent_parent). The exploit script writes a config file, restarts a container, and checks for command execution inside that container. There is no evidence of host escape, external connections, persistence, credential theft, or destructive actions beyond the intended demonstration of the vulnerability.
exploit.py:100-227This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.
A 3-node Netdata streaming chain (agent_child → agent_middle → agent_parent) running vulnerable Netdata v1.36.1, designed as a proof-of-concept environment for CVE-2023-22496.
docker-compose.yaml:1-6README.md:1-7The README explicitly states it is a PoC for CVE-2023-22496, the docker-compose.yaml sets up a vulnerable streaming chain, and exploit.py automates the injection and verification of the command injection vulnerability.
README.md:1-7docker-compose.yaml:1-6exploit.py:1-10Runs Netdata v1.36.1, accepts streams from agent_middle, evaluates health alarms, and is the target of the command injection. Its netdata.conf is mounted writable so the exploit can inject a malicious registry_hostname.
docker-compose.yaml:22-38README.md:67-72Runs Netdata v1.36.1, receives streams from agent_child and forwards them to agent_parent. It propagates the registry_hostname without sanitization.
docker-compose.yaml:40-56README.md:67-72Runs Netdata v1.36.1, configured to stream to agent_middle. Represents the attacker's entry point in the streaming chain.
docker-compose.yaml:58-74README.md:67-72Python script that overwrites config/parent_netdata.conf with a malicious registry_hostname, restarts agent_parent, waits for a health alarm, and verifies command execution on the target.
exploit.py:1-10exploit.py:100-227Supported by supplied evidence
The README and exploit.py describe the vulnerability as an OS command injection in Netdata's health alarm system via unsanitized registry_hostname, matching the CVE description. The lab environment uses Netdata v1.36.1, which is within the affected range (<1.37.0).
README.md:1-7README.md:13-30exploit.py:1-10docker-compose.yaml:8-9README.md:103-108README.md:99-102README.md:110-112exploit.py:100-105README.md:103-108README.md:110-112README.md:120-122exploit.py:100-105README.md:124-126exploit.py:200-210All visible behavior is directed at the contained lab target (agent_parent). The exploit overwrites a lab config file, restarts the target container, and executes a user-supplied command inside that container. No evidence of host escape, external connectivity, persistence, credential theft, or destructive behavior beyond the intended lab exercise.
exploit.py:100-227docker-compose.yaml:22-38This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.