ET WEB_SPECIFIC_APPS LibreNMS WHOIS query Parameter Command Injection Attempt (CVE-2026-6204)

alert http any any -> $HOME_NET any (
    msg:"ET WEB_SPECIFIC_APPS LibreNMS WHOIS query Parameter Command Injection Attempt (CVE-2026-6204)";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.uri;
    content:"/ajax/netcmd|3f|cmd|3d|whois|26|query|3d|"; fast_pattern;
    reference:url,projectblack.io/blog/librenms-authenticated-rce-and-xss/#binary-path-rce-poc;
    reference:cve,2026-6204;
    classtype:attempted-admin;
    sid:2068848; rev:1;
    metadata:affected_product LibreNMS, attack_target Web_Server, tls_state TLSDecrypt, created_at 2026_04_20, deployment Perimeter, deployment Internal, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Unknown, tag Exploit, updated_at 2026_04_20, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;
    target:dest_ip;
)