CVE-2024-51497: Stored XSS Vulnerability in LibreNMS Custom OID Functionality
Summary
CVE-2024-51497: LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-customoid.php. Affects librenms/librenms versions < 24.10.0. Fixed in 24.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibreNMS is an open-source network monitoring tool that provides a comprehensive suite of features for monitoring network devices. It allows users to track performance metrics, visualize network data, and manage alerts. The application supports custom Object Identifiers (OIDs) for enhanced monitoring capabilities. However, a vulnerability has been identified in the Custom OID functionality, which can be exploited by authenticated users to inject malicious scripts.
Vulnerability Detail
The vulnerability is a Stored Cross-Site Scripting (XSS) issue located in the Custom OID tab of LibreNMS. It arises from improper sanitization of the 'unit' parameter when creating new OIDs. An attacker can inject arbitrary JavaScript code through this parameter, which is then executed in the context of other users' sessions when they view the Custom OID tab. This can lead to account compromise and unauthorized actions, as the malicious code runs with the privileges of the affected user.
How To Fix
Minimum fixed version
24.10.0
This is the first release that contains the fix.
composer require librenms/librenms:24.10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the Custom OID functionality to trusted users only, until the package can be updated to the patched version.
Conclusion
CVE-2024-51497 represents a significant security risk for users of LibreNMS due to its potential for exploitation through stored XSS. It is crucial for users to update to the latest version to mitigate this risk and ensure the security of their network monitoring environment.
See every vulnerability recorded for librenms/librenms →
FAQ
CVE-2024-51497 is a Stored XSS vulnerability in the LibreNMS application that allows authenticated users to inject and execute arbitrary JavaScript code.
Authenticated users of LibreNMS who have access to the Custom OID functionality are at risk of this vulnerability.
The vulnerability can lead to account compromise, unauthorized actions, and the execution of malicious scripts in the context of other users' sessions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2024-51497 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for librenms/librenms.
