CVE-2024-47526: LibreNMS Self-XSS Vulnerability in Alert Templates Feature
Summary
CVE-2024-47526: LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Templates" feature. Affects librenms/librenms versions < 24.9.0. Fixed in 24.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibreNMS is an open-source network monitoring tool that provides a range of features for monitoring network devices, including alerts, performance metrics, and reporting. It is widely used for its flexibility and ease of integration with various network devices. The application allows users to create custom alert templates to manage notifications effectively. However, a vulnerability in the Alert Templates feature exposes users to potential self-cross-site scripting (Self-XSS) attacks, which can compromise user sessions.
Vulnerability Detail
A Self-Cross-Site Scripting (Self-XSS) vulnerability exists in the Alert Templates feature of LibreNMS. This vulnerability allows users to inject arbitrary JavaScript into the name of an alert template. The injected script executes immediately upon submission of the template but does not persist after a page refresh. The issue arises because the application does not sanitize the 'name' field before rendering it in the user interface, allowing malicious scripts to be executed in the context of the user's session. Although the risk is lower compared to traditional XSS, it can still be exploited through social engineering, leading to unauthorized actions or data exposure.
How To Fix
Minimum fixed version
24.9.0
This is the first release that contains the fix.
composer require librenms/librenms:24.9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid entering any script or HTML tags in the 'Name' field when creating alert templates. This can help mitigate the risk of Self-XSS until the application is updated.
Conclusion
The Self-XSS vulnerability in the Alert Templates feature of LibreNMS poses a risk to users by allowing the injection of arbitrary JavaScript. While the vulnerability does not persist after a page refresh, it can still be exploited through social engineering. Users are advised to upgrade to version 24.9.0 or later to mitigate this risk.
See every vulnerability recorded for librenms/librenms →
FAQ
Self-XSS is a type of cross-site scripting attack where the victim is tricked into executing malicious scripts in their own browser, often through social engineering.
You can check your version of LibreNMS and compare it with the fixed version (24.9.0). Additionally, you can use Vulert to monitor for vulnerabilities in your application.
The potential impacts include unauthorized actions or data exposure within the context of the affected user's session, especially if they are tricked into executing malicious scripts.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using the composer.lock file. You can check your application for vulnerabilities using the Vulert playground.
If an immediate upgrade is not possible, refrain from using the Alert Templates feature or avoid entering any potentially malicious input in the 'Name' field.
References
Related vulnerabilities
Recent vulnerabilities recorded for librenms/librenms.
