CVE-2024-47524: Stored XSS Vulnerability in LibreNMS Device Group Name
Summary
CVE-2024-47524: LibreNMS has Stored Cross-site Scripting vulnerability in "Device Group" Name. Affects librenms/librenms versions < 24.9.0. Fixed in 24.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibreNMS is an open-source network monitoring tool that provides a robust platform for managing and monitoring network devices. It offers features such as device discovery, performance monitoring, and alerting. However, it has a vulnerability related to the improper sanitization of user inputs in the naming of Device Groups, which can lead to security risks.
Vulnerability Detail
The vulnerability arises from the failure of LibreNMS to properly sanitize inputs when creating Device Groups. An attacker with Admin privileges can create a Device Group with a malicious JavaScript payload in its name. When other users view the details of this Device Group, the malicious code is executed in their browsers, potentially leading to cookie theft or other malicious actions. This vulnerability affects all users who have access to the Device Group detail page, making it a significant security concern.
How To Fix
Minimum fixed version
24.9.0
This is the first release that contains the fix.
composer require librenms/librenms:24.9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict the ability to create Device Groups to trusted users only, and monitor the names of Device Groups for any suspicious content until the software can be updated.
Conclusion
The stored XSS vulnerability in LibreNMS (CVE-2024-47524) poses a significant risk to users by allowing the execution of malicious scripts through improperly sanitized inputs. It is crucial to update to version 24.9.0 or later to mitigate this risk and ensure the security of your network monitoring environment.
See every vulnerability recorded for librenms/librenms →
FAQ
CVE-2024-47524 is a stored cross-site scripting (XSS) vulnerability in LibreNMS that allows attackers to execute malicious JavaScript code through improperly sanitized Device Group names.
All users of LibreNMS who have access to the Device Group detail page are affected, especially those with Admin privileges who can create Device Groups.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.2, indicating a high severity level.
If you cannot update immediately, consider restricting access to the Device Group creation feature and monitor existing groups for any malicious content.
References
Related vulnerabilities
Recent vulnerabilities recorded for librenms/librenms.
