CVE-2024-56144: Stored XSS-LibreNMS-Display Name 2 in librenms
StoredXSS-LibreNMS-Display Name 2
Description:
XSS on the parameters (Replace $DEVICEID with your specific $DEVICEID value):/device/$DEVICEID/edit -> param: display
of Librenms versions 24.11.0 (https://github.com/librenms/librenms) allows remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure.
Proof of Concept: 1. Add a new device through the LibreNMS interface. 2. Edit the newly created device by going to the "Device Settings" section. 3. In the "Display Name" field, enter the following payload: "><img src onerror="alert(document.cookie)">. !image 4. Save the changes. 5. The XSS payload is triggered when navigating to the path /device/$DEVICEID/logs and hovering over a type containing a tag (such as Core 1 in the image). !image
Impact:
Execution of Malicious Code
Other sources
librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameters (Replace $DEVICEID with your specific $DEVICEID value):/device/$DEVICEID/edit -> param: display. Librenms versions up to 24.11.0 allow remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure. This issue has been addressed in release version 24.12.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56144?
The severity of CVE-2024-56144 is classified as medium, as it allows for stored cross-site scripting vulnerabilities.
How do I fix CVE-2024-56144?
To fix CVE-2024-56144, upgrade LibreNMS to version 24.12.0 or later.
Which versions of LibreNMS are affected by CVE-2024-56144?
LibreNMS versions 24.11.0 to 24.11.10 are affected by CVE-2024-56144.
What type of vulnerability is CVE-2024-56144?
CVE-2024-56144 is a stored cross-site scripting (XSS) vulnerability.
Where does CVE-2024-56144 occur in LibreNMS?
CVE-2024-56144 occurs when editing the display name parameter for a device at the URL /device/$DEVICE_ID/edit.