CVE-2024-47528: LibreNMS Contains a Stored XSS via File Upload
Summary Stored Cross-Site Scripting (XSS) can archive via Uploading a new Background for a Custom Map.
Details Users with "admin" role can set background for a custom map, this allow the upload of SVG file that can contain XSS payload which will trigger onload. This led to Stored Cross-Site Scripting (XSS).
PoC 1. Login using an Admin role account.
2. Go over to "$URL/maps/custom", the Manage Custom Maps. !image
3. Create a new map then choose to edit it. 4. Choose the "Set Background" option. !image
5. Choose to upload a SVG file that have this content. svg <svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"> <circle cx="50" cy="50" r="40" /> </svg>
6. Once uploaded, there should be a link to the SVG return in the POST request to the API "$URL/maps/custom/1/background". !image
7. Go over to that link on browser, should see a pop-up. !image
Impact Attacker can use this to perform malicious java script code for malicious intent. This would impact other Admin role users and the Global Read role users. Normal users does not have permission to read the file, so they are not affected.
Other sources
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Stored Cross-Site Scripting (XSS) can be achieved by uploading a new Background for a Custom Map. Users with "admin" role can set background for a custom map, this allow the upload of SVG file that can contain XSS payload which will trigger on load. This led to Stored Cross-Site Scripting (XSS). The vulnerability is fixed in 24.9.0.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47528?
CVE-2024-47528 is rated as a high severity vulnerability due to the potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2024-47528?
To mitigate CVE-2024-47528, users should upgrade to Librenms version 24.9.0 or later, which addresses this vulnerability.
Who is affected by CVE-2024-47528?
CVE-2024-47528 affects users with 'admin' role privileges in Librenms versions prior to 24.9.0.
What type of attack is CVE-2024-47528 associated with?
CVE-2024-47528 is associated with stored cross-site scripting (XSS) due to the upload of SVG files.
What can an attacker do with CVE-2024-47528?
An attacker could exploit CVE-2024-47528 to inject malicious scripts through uploaded SVG files, which could execute in the context of other users.