CVE-2021-26753
📋 TL;DR
CVE-2021-26753 is an authenticated remote code execution vulnerability in NeDi network management software. An authenticated attacker can inject PHP code via the System-Files.php endpoint, potentially gaining full control of the NeDi server and access to all application data. This affects NeDi 1.9C installations with authenticated user access.
💻 Affected Systems
- NeDi
📦 What is this software?
Nedi by Nedi
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the NeDi server, lateral movement to other systems, data exfiltration, and persistent backdoor installation.
Likely Case
Attacker gains shell access to the NeDi server, accesses network monitoring data, and potentially compromises credentials stored in the application.
If Mitigated
Limited impact due to network segmentation, minimal user privileges, and proper input validation preventing code execution.
🎯 Exploit Status
Exploitation is straightforward with authenticated access; public proof-of-concept demonstrates PHP code injection via POST parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9D or later
Vendor Advisory: https://www.nedi.ch/
Restart Required: No
Instructions:
1. Backup NeDi configuration and data. 2. Download and install NeDi 1.9D or newer from the official website. 3. Verify the update by checking the version in the web interface.
🔧 Temporary Workarounds
Input Validation Filter
linuxAdd input validation to filter PHP code in the txt parameter of System-Files.php
Modify /path/to/nedi/System-Files.php to sanitize $_POST['txt'] input
Access Restriction
allRestrict access to System-Files.php to admin users only via web server configuration
Add location block in nginx/apache to limit access to trusted IPs or require additional authentication
🧯 If You Can't Patch
- Implement strict network segmentation to isolate NeDi server from critical systems
- Enforce least privilege for NeDi user accounts and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check NeDi version via web interface or by examining installation files; version 1.9C is vulnerable.Check Version:
grep -i version /path/to/nedi/inc/lib.php or check web interface footerVerify Fix Applied:
Verify version is 1.9D or newer and test that PHP code injection via txt parameter is blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to System-Files.php with PHP code in parameters
- Unexpected file creations or system commands in NeDi logs
Network Indicators:
- HTTP traffic to System-Files.php with suspicious payloads in POST data
SIEM Query:
source="nedi.log" AND "System-Files.php" AND ("eval(" OR "system(" OR "shell_exec(")