CVE-2021-43324: Cross-site Scripting in LibreNMS
Summary
CVE-2021-43324: Cross-site Scripting in LibreNMS. Affects librenms/librenms versions < 21.11.0. Fixed in 21.11.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
LibreNMS is an open-source network monitoring and management system. It provides a comprehensive set of features for monitoring network devices, collecting performance data, and generating alerts. LibreNMS is widely used in various organizations to monitor and manage their network infrastructure. However, a vulnerability has been discovered in LibreNMS versions up to 21.10.2 that allows for cross-site scripting (XSS) attacks. This vulnerability can be exploited by an attacker to inject malicious scripts into the application, potentially leading to unauthorized access, data theft, or other malicious activities.
Vulnerability Detail
The vulnerability in LibreNMS is due to insufficient input sanitization in the widget title field. An attacker can craft a malicious widget title containing JavaScript code, which will be executed when the widget is rendered in the user's browser. This allows the attacker to perform various actions on behalf of the user, such as stealing sensitive information, modifying the user interface, or performing unauthorized actions. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
21.11.0
This is the first release that contains the fix.
composer require librenms/librenms:21.11.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by disabling the affected widgets or removing any custom titles that may contain untrusted input. This can be done by accessing the LibreNMS web interface, navigating to the widget configuration page, and either disabling the vulnerable widgets or removing the custom titles. It is important to note that this workaround is not a permanent solution and should only be used as a temporary measure until the upgrade can be performed.
Conclusion
The vulnerability in LibreNMS allows for cross-site scripting attacks, which can have serious consequences for affected systems. It is crucial to upgrade to the latest patched version of LibreNMS (21.10.3 or later) to mitigate the risk. If immediate upgrade is not possible, disabling the vulnerable widgets or removing custom titles can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for librenms/librenms →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code in the context of the user's browser. This can lead to various malicious activities, such as stealing sensitive information, modifying the user interface, or performing unauthorized actions.
No, only versions up to 21.10.2 are affected. The vulnerability has been fixed in version 21.10.3 and later.
No, authentication is not required. An attacker can exploit this vulnerability by sending a specially crafted request to the vulnerable LibreNMS instance.
There have been no reports of this vulnerability being exploited in the wild at the time of this advisory. However, it is recommended to apply the necessary patches or upgrades to mitigate the risk.
You can find more information about the vulnerability, including the CVE identifier, in the official GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-46rx-6jg9-4fh8/GHSA-46rx-6jg9-4fh8.json
References
Related vulnerabilities
Recent vulnerabilities recorded for librenms/librenms.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
