CVE-2021-31274: Cross-site Scripting in LibreNMS
Summary
CVE-2021-31274: Cross-site Scripting in LibreNMS. Affects librenms/librenms versions < 21.3.0. Fixed in 21.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibreNMS is an open-source network monitoring and management tool. It provides a comprehensive platform for monitoring network devices, servers, and applications. LibreNMS allows users to access its functionality through an API. However, versions prior to 21.3.0 are vulnerable to a stored cross-site scripting (XSS) attack. This vulnerability arises due to inadequate sanitization of the $api->description variable on the API Access page. As a result, an attacker can inject and execute arbitrary JavaScript code.
Vulnerability Detail
The stored XSS vulnerability in LibreNMS can have serious consequences. An attacker can exploit this vulnerability by injecting malicious JavaScript code into the API Access page. When a user with sufficient privileges accesses the page, the injected code gets executed in their browser. This allows the attacker to perform various malicious actions, such as stealing sensitive information, hijacking user sessions, or performing unauthorized actions on behalf of the user. The vulnerability is classified as CWE-79, which is the Common Weakness Enumeration for Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
How To Fix
Minimum fixed version
21.3.0
This is the first release that contains the fix.
composer require librenms/librenms:21.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, users can apply a temporary workaround by manually sanitizing the $api->description variable before displaying it on the API Access page. This can be done by implementing proper input validation and output encoding techniques to neutralize any potential XSS payloads. Here is an example of how the variable can be sanitized in PHP:
$description = htmlspecialchars($api->description, ENT_QUOTES, 'UTF-8');
Conclusion
In conclusion, LibreNMS versions prior to 21.3.0 are vulnerable to a stored XSS attack due to insufficient sanitization of the $api->description variable. This vulnerability can be mitigated by upgrading to the latest version or applying proper input validation and output encoding techniques. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for librenms/librenms →
FAQ
LibreNMS is an open-source network monitoring and management tool that provides comprehensive monitoring capabilities for network devices, servers, and applications.
A stored XSS vulnerability is a type of cross-site scripting attack where the malicious payload is permanently stored on the target server, allowing it to be executed whenever a user accesses the affected page or resource.
An attacker can exploit this vulnerability by injecting malicious JavaScript code into the API Access page of LibreNMS. When a user with sufficient privileges accesses the page, the injected code gets executed in their browser, enabling the attacker to perform various malicious actions.
The consequences of this vulnerability can be severe. An attacker can use it to steal sensitive information, hijack user sessions, or perform unauthorized actions on behalf of the user.
To protect your LibreNMS installation, it is crucial to upgrade to version 21.3.0 or later, which includes the necessary fix for this vulnerability. Additionally, it is recommended to follow secure coding practices, such as input validation and output encoding, to mitigate the risk of XSS attacks.
Related vulnerabilities
Recent vulnerabilities recorded for librenms/librenms.
