CVE-2024-50350: LibreNMS Stored XSS Vulnerability in Port Settings Page
Summary
CVE-2024-50350: A Stored Cross-Site Scripting (XSS) vulnerability in the "Port Settings" page allows authenticated users to inject arbitrary JavaScript through the "name" parameter when creating a new Port Group. Affects librenms/librenms versions < 24.10.0. Fixed in 24.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibreNMS is an open-source network monitoring tool that provides a comprehensive platform for monitoring network devices and services. It offers features such as device discovery, alerting, and performance metrics. However, it is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability that can be exploited by authenticated users to inject malicious scripts.
Vulnerability Detail
The vulnerability arises from insufficient sanitization of the 'name' parameter when creating a new Port Group in the Port Settings page. An attacker can inject arbitrary JavaScript code, which executes when other users visit the affected page. This could lead to session hijacking, unauthorized actions, and compromise of user accounts. The vulnerability is particularly concerning as it allows for the execution of malicious scripts in the context of other users' sessions.
How To Fix
Minimum fixed version
24.10.0
This is the first release that contains the fix.
composer require librenms/librenms:24.10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the Port Settings page until the package is updated. Additionally, ensure that only trusted users have access to the system to minimize the risk of exploitation.
Conclusion
The Stored XSS vulnerability in LibreNMS poses significant risks to user accounts and system integrity. It is crucial to update to the latest version to mitigate these risks and ensure the security of the application.
See every vulnerability recorded for librenms/librenms →
FAQ
CVE-2024-50350 is a Stored XSS vulnerability in LibreNMS that allows authenticated users to inject malicious JavaScript through the Port Settings page.
An attacker can exploit this vulnerability by injecting a malicious script into the 'name' parameter when creating a Port Group, which executes when other users visit the Port Settings page.
The potential impacts include session hijacking, unauthorized actions performed on behalf of users, and compromise of user accounts.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for librenms/librenms.
