CVE-2024-51496: Reflected XSS Vulnerability in LibreNMS Package
Summary
CVE-2024-51496: LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/html/pages/wireless.inc.php. Affects librenms/librenms versions < 24.10.0. Fixed in 24.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibreNMS is an open-source network monitoring tool that provides a robust platform for monitoring network devices and services. It features an intuitive web interface, supports a wide range of devices, and offers alerting capabilities. However, like many web applications, it is susceptible to security vulnerabilities, including Cross-Site Scripting (XSS), which can compromise user sessions and lead to unauthorized actions.
Vulnerability Detail
The vulnerability is a Reflected Cross-Site Scripting (XSS) issue found in the 'metric' parameter of the '/wireless' and '/health' endpoints. Attackers can exploit this vulnerability by injecting arbitrary JavaScript code into the 'metric' parameter, which executes when a user accesses the page with the malicious parameter. This occurs due to inadequate sanitization of user input, allowing for the execution of harmful scripts in the context of the user's session. The potential ramifications include session hijacking and unauthorized actions, making it a critical security concern.
How To Fix
Minimum fixed version
24.10.0
This is the first release that contains the fix.
composer require librenms/librenms:24.10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid accessing the '/wireless' and '/health' endpoints with untrusted or manipulated 'metric' parameters until the package is updated. Additionally, implementing input validation and sanitization on the server side can help mitigate the risk of XSS attacks.
Conclusion
CVE-2024-51496 is a significant reflected XSS vulnerability in the LibreNMS package that can lead to severe security implications for users. It is crucial to update to the latest version to mitigate this risk and ensure the safety of user sessions. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for librenms/librenms →
FAQ
CVE-2024-51496 is a reflected XSS vulnerability in the LibreNMS package that allows attackers to inject and execute arbitrary JavaScript code.
If you are using LibreNMS version 24.9.1 or earlier, your installation is vulnerable. You can check your version in the application settings or by running 'composer show' in your project directory.
The vulnerability can lead to session hijacking, unauthorized actions, and further exploitation through malicious scripts, compromising user security.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using the composer.lock file. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
The CVSS score for CVE-2024-51496 is 7.5, indicating a high severity level for this security issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for librenms/librenms.
