CVE-2026-28517: openDCIM OS Command Injection Vulnerability

CVE-2026-28517 Overview

CVE-2026-28517 is a critical OS command injection vulnerability affecting openDCIM version 23.04 through commit 4467e9c4. The vulnerability exists in report_network_map.php, where the application retrieves the dot configuration parameter from the database and passes it directly to exec() without any validation or sanitization. If an attacker can modify the fac_Config.dot value in the database, arbitrary commands may be executed in the context of the web server process.

Critical Impact

This command injection vulnerability allows remote attackers to execute arbitrary OS commands on the underlying server with the privileges of the web server process, potentially leading to complete system compromise.

Affected Products

• openDCIM version 23.04 (through commit 4467e9c4)

Discovery Timeline

• 2026-02-27 - CVE CVE-2026-28517 published to NVD
• 2026-03-02 - Last updated in NVD database

Technical Details for CVE-2026-28517

Vulnerability Analysis

This vulnerability falls under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The flaw stems from the application's failure to properly validate or sanitize user-controllable input before incorporating it into operating system commands.

The vulnerable code path exists in report_network_map.php, where the application reads the dot configuration parameter from the fac_Config database table. This value is then passed directly to PHP's exec() function without any input validation, output encoding, or command-line argument escaping. The dot parameter is intended to specify the path to the Graphviz dot binary for generating network topology diagrams.

An attacker who gains the ability to modify the database value—such as through a SQL injection vulnerability or direct database access—can inject malicious commands that will be executed with the privileges of the web server process (typically www-data or apache).

Root Cause

The root cause is improper input validation and missing sanitization of the fac_Config.dot configuration parameter before it is used in an exec() call. The application trusts database-stored configuration values without recognizing that these values could be manipulated by an attacker. This represents a failure to apply defense-in-depth principles, where even trusted data sources should be validated before use in security-sensitive operations like command execution.

Attack Vector

The attack requires the ability to modify the dot configuration value in the openDCIM database. This could be achieved through:

1. Chained exploitation - Combining this vulnerability with a SQL injection flaw to modify the fac_Config table
2. Compromised database credentials - Direct database access using stolen or weak credentials
3. Insider threat - A malicious user with database write access

Once the attacker can set a malicious value for the dot parameter, they can inject shell metacharacters and additional commands. For example, setting the value to ; whoami # or /bin/bash -c "malicious_command" would result in arbitrary command execution when the report_network_map.php script is accessed.

The vulnerability is network-accessible and requires no user interaction once the malicious configuration is in place. Technical details and proof-of-concept information are available in the Chocapikk SQLi to RCE Post and the GitHub openDCIM Exploit repository.

Detection Methods for CVE-2026-28517

Indicators of Compromise

• Unexpected modifications to the fac_Config table, particularly the dot parameter value
• Web server process spawning unusual child processes such as reverse shells or data exfiltration tools
• Suspicious entries in web server access logs accessing report_network_map.php with abnormal frequency
• Evidence of shell metacharacters (;, |, &&, `, $()) in database configuration values

Detection Strategies

• Monitor database audit logs for UPDATE queries targeting the fac_Config table
• Implement file integrity monitoring on openDCIM PHP files and configuration
• Deploy web application firewall (WAF) rules to detect command injection patterns in requests
• Use endpoint detection and response (EDR) solutions to monitor for web server processes executing unexpected commands

Monitoring Recommendations

• Enable detailed logging for PHP exec(), system(), and similar dangerous functions
• Configure SIEM alerts for web server child process creation with suspicious command lines
• Monitor network traffic from web servers for unusual outbound connections indicative of reverse shells
• Review openDCIM application logs and database query logs for signs of SQL injection attempts

How to Mitigate CVE-2026-28517

Immediate Actions Required

• Update openDCIM to a patched version that includes the fix from pull request #1664
• Audit the fac_Config table for any unexpected or suspicious values in the dot parameter
• Restrict database access permissions to prevent unauthorized modification of configuration tables
• Implement network segmentation to limit access to the openDCIM application and its database

Patch Information

The openDCIM maintainers have addressed this vulnerability in pull request #1664. The specific code changes can be reviewed in the commit 8f7ab2a. Organizations should apply this patch immediately or upgrade to a version containing the fix. For additional technical context, refer to the VulnCheck advisory.

Workarounds

• Validate and hardcode the path to the dot binary in the application configuration rather than retrieving it from the database
• Implement database triggers or constraints to prevent modification of the dot configuration parameter
• Run the web server with minimal privileges and in a sandboxed environment to limit the impact of command execution
• Disable or restrict access to report_network_map.php if the network mapping feature is not required

# Verify current dot configuration value in the database
mysql -u opendcim_user -p opendcim_db -e "SELECT * FROM fac_Config WHERE Parameter='dot';"

# Reset to safe default value if tampering is suspected
mysql -u opendcim_user -p opendcim_db -e "UPDATE fac_Config SET Value='/usr/bin/dot' WHERE Parameter='dot';"