From 8b82341cb742e7bd4966964b399012f7ba017e0b Mon Sep 17 00:00:00 2001
From: Tony Murray <murraytony@gmail.com>
Date: Wed, 20 Apr 2022 21:32:36 -0500
Subject: [PATCH] Fix services command injection (#13932)

* fix services command injection

* Clean more variables

* Update services.inc.php

* Update services.inc.php
---
 includes/services.inc.php | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/includes/services.inc.php b/includes/services.inc.php
index a4c33161c1..ddfaf63838 100644
--- a/includes/services.inc.php
+++ b/includes/services.inc.php
@@ -4,6 +4,7 @@ use App\Models\Device;
 use LibreNMS\Alert\AlertRules;
 use LibreNMS\Config;
 use LibreNMS\RRD\RrdDefinition;
+use LibreNMS\Util\Clean;
 
 function get_service_status($device = null)
 {
@@ -120,6 +121,10 @@ function poll_service($service)
 {
     $update = [];
     $old_status = $service['service_status'];
+    $service['service_type'] = Clean::fileName($service['service_type']);
+    $service['service_ip'] = Clean::fileName($service['service_ip']);
+    $service['hostname'] = Clean::fileName($service['hostname']);
+    $service['overwrite_ip'] = Clean::fileName($service['overwrite_ip']);
     $check_cmd = '';
 
     // if we have a script for this check, use it.
@@ -130,7 +135,7 @@ function poll_service($service)
 
     // If we do not have a cmd from the check script, build one.
     if ($check_cmd == '') {
-        $check_cmd = Config::get('nagios_plugins') . '/check_' . $service['service_type'] . ' -H ' . ($service['service_ip'] ? $service['service_ip'] : $service['hostname']);
+        $check_cmd = Config::get('nagios_plugins') . '/check_' . $service['service_type'] . ' -H ' . ($service['service_ip'] ?: $service['hostname']);
         $check_cmd .= ' ' . $service['service_param'];
     }