CVE-2024-32479: LibreNMS's Improper Sanitization on Service template name leads to Stored XSS
Summary There is improper sanitization on Service template name which is reflecting in delete button onclick event. This value can be modified and crafted as any other javascript code.
Vulnerable Code https://github.com/librenms/librenms/blob/a61c11db7e8ef6a437ab55741658be2be7d14d34/app/Http/Controllers/ServiceTemplateController.php#L67C23-L67C23
Above is vulnerable code line which needs to be properly sanitized
PoC 1. Go to /services/templates 2. Enter name as testing', '14', 'http://172.105.62.194:8000/services/templates/14');alert(1);// 3. Submit it and try to delete it, you will see popup
If you inspect element on delete button, you will notice this:- <img width="748" alt="Screenshot 2023-11-23 at 9 30 24 PM" src="https://user-images.githubusercontent.com/31764504/285260018-7672a93d-e29b-4444-8057-e6ffcb8dabfc.png">
Impact Cross site scripting can lead to cookie stealing or an attacker can execute any other feature using this feature.
Other sources
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Prior to version 24.4.0, there is improper sanitization on the Service template name, which can lead to stored Cross-site Scripting. Version 24.4.0 fixes this vulnerability.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-32479?
CVE-2024-32479 has been classified as a high severity vulnerability due to improper sanitization that allows potential javascript code injection.
How do I fix CVE-2024-32479?
To fix CVE-2024-32479, update your LibreNMS installation to version 24.4.0 or later.
What does CVE-2024-32479 exploit?
CVE-2024-32479 exploits improper sanitization on the service template name, specifically affecting the delete button's onclick event.
What software versions are affected by CVE-2024-32479?
CVE-2024-32479 affects LibreNMS versions prior to 24.4.0.
What are the potential consequences of CVE-2024-32479?
Exploitation of CVE-2024-32479 could allow an attacker to execute arbitrary javascript code in the context of the affected application.