CVE-2024-50355: LibreNMS Persistent XSS Vulnerability Due to Insecure Input Sanitization
Summary
CVE-2024-50355: LibreNMS has a Persistent XSS from Insecure Input Sanitization Affects Multiple Endpoints. Affects librenms/librenms versions < 24.10.0. Fixed in 24.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibreNMS is an open-source network monitoring tool that provides a comprehensive solution for managing network devices. It allows users to monitor the status and performance of various devices, generate alerts, and visualize network data. However, it has been found to have a vulnerability that arises from improper input sanitization, which can lead to security risks for users.
Vulnerability Detail
The vulnerability in LibreNMS stems from its failure to properly sanitize user inputs, particularly in the Display Name field of devices. This allows an attacker with admin privileges to inject malicious JavaScript code. When other users interact with the affected fields, the injected code can execute in their browsers, potentially compromising their accounts and allowing unauthorized actions. The vulnerability is classified as a Persistent Cross-Site Scripting (XSS) issue, which can have severe implications for user security and data integrity.
How To Fix
Minimum fixed version
24.10.0
This is the first release that contains the fix.
composer require librenms/librenms:24.10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators should avoid using special characters or JavaScript code in the Display Name field of devices until the application is updated. This can help mitigate the risk of XSS attacks while waiting for a permanent fix.
Conclusion
The CVE-2024-50355 vulnerability in LibreNMS highlights the importance of proper input sanitization to prevent XSS attacks. Users are strongly advised to update to the latest version to mitigate risks and protect their accounts from potential exploitation.
See every vulnerability recorded for librenms/librenms →
FAQ
The vulnerability is a Persistent XSS issue that allows attackers to inject malicious JavaScript code into the application.
Authenticated users with admin privileges can exploit this vulnerability, potentially affecting all users who interact with the compromised fields.
If exploited, the vulnerability could allow attackers to execute arbitrary JavaScript code in the context of other users' sessions, leading to account compromise and unauthorized actions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.2, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for librenms/librenms.
