CVE-2024-49758: LibreNMS Stored XSS Vulnerability in Device Notes
Summary
CVE-2024-49758: LibreNMS has a stored XSS in ExamplePlugin with Device's Notes. Affects librenms/librenms versions < 24.10.0. Fixed in 24.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
LibreNMS is an open-source network monitoring tool that provides a range of features for managing and monitoring network devices. It allows users to collect and visualize data from various devices, enabling efficient network management. However, a vulnerability has been identified in the ExamplePlugin, which allows for the injection of malicious JavaScript code through the device's Notes feature, compromising user security.
Vulnerability Detail
The vulnerability arises from inadequate input sanitization within the LibreNMS application. Specifically, when an admin user adds notes to a device, the application fails to properly sanitize the input. If JavaScript code is included in the device's Notes, it will execute when the ExamplePlugin is enabled and the device overview is accessed. This stored cross-site scripting (XSS) vulnerability can lead to unauthorized actions being performed on behalf of other users, potentially compromising their accounts and sensitive information.
How To Fix
Minimum fixed version
24.10.0
This is the first release that contains the fix.
composer require librenms/librenms:24.10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the ExamplePlugin to prevent the execution of any malicious scripts until the package is updated. This can be done through the LibreNMS admin interface by navigating to the plugin settings and disabling the ExamplePlugin.
Conclusion
The CVE-2024-49758 vulnerability in LibreNMS highlights the importance of input sanitization in web applications. Users are advised to update to the latest version to mitigate risks associated with this stored XSS vulnerability. Regular monitoring and updates are essential for maintaining the security of open-source software.
See every vulnerability recorded for librenms/librenms →
FAQ
CVE-2024-49758 is a stored XSS vulnerability found in the LibreNMS network monitoring tool that allows attackers to execute malicious JavaScript code through device notes.
Authenticated users with admin privileges who can add notes to devices in LibreNMS are affected by this vulnerability.
The vulnerability can lead to account compromise, allowing attackers to perform unauthorized actions in the context of other users' sessions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 6.8, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for librenms/librenms.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
