CVE-2024-56144: LibreNMS Stored XSS Vulnerability in Display Name Field
Summary
CVE-2024-56144: LibreNMS Display Name 2 Stored Cross-site Scripting vulnerability. Affects librenms/librenms versions >= 24.11.10, < 24.12.0. Fixed in 24.12.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibreNMS is an open-source network monitoring tool that provides a robust platform for monitoring network devices and services. It offers features such as device discovery, alerting, and performance monitoring. However, like many web applications, it is susceptible to security vulnerabilities, including cross-site scripting (XSS), which can compromise user data and application integrity.
Vulnerability Detail
The vulnerability identified as CVE-2024-56144 is a stored cross-site scripting (XSS) flaw found in the LibreNMS application. This issue arises when user input is not properly sanitized, allowing attackers to inject malicious scripts into the 'Display Name' field of device settings. When a user views the affected page, the injected script executes, potentially leading to unauthorized actions, data exposure, and a compromised user experience. The vulnerability affects LibreNMS versions prior to 24.12.0, with the potential for significant impact on user security and application functionality.
How To Fix
Minimum fixed version
24.12.0
This is the first release that contains the fix.
composer require librenms/librenms:24.12.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid entering potentially malicious scripts in the 'Display Name' field. Additionally, implementing input validation and sanitization on the server side can help mitigate the risk until the application is updated.
Conclusion
CVE-2024-56144 is a significant stored XSS vulnerability in LibreNMS that can lead to serious security risks. Users are strongly advised to update their installations to the latest version to mitigate these risks. Regular monitoring and vulnerability management practices, such as using Vulert, can help maintain the security of your applications.
See every vulnerability recorded for librenms/librenms →
FAQ
CVE-2024-56144 is a stored cross-site scripting vulnerability in LibreNMS that allows attackers to inject malicious scripts through the 'Display Name' field.
If you are using LibreNMS version 24.11.0 or earlier, your installation is vulnerable to CVE-2024-56144.
The vulnerability can lead to unauthorized actions, data exposure, and a compromised user experience due to the execution of malicious scripts.
You can update LibreNMS by running 'composer update librenms/librenms' in your terminal, ensuring you are on version 24.12.0 or later.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using the composer.lock file. You can also check your application using the Vulert playground at Vulert Scanner without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for librenms/librenms.
