CVE-2024-32461
📋 TL;DR
This SQL injection vulnerability in LibreNMS allows authenticated users with global read privileges to execute arbitrary SQL commands via the package parameter in the search endpoint. Attackers can exploit this to extract sensitive data like administrator credentials from the database. Only LibreNMS versions prior to 24.4.0 are affected.
💻 Affected Systems
- LibreNMS
📦 What is this software?
Librenms by Librenms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to credential theft, data exfiltration, and potential privilege escalation to full system control.
Likely Case
Extraction of administrator credentials and sensitive monitoring data, leading to unauthorized access and potential lateral movement.
If Mitigated
Limited impact if proper network segmentation and least privilege access controls are implemented.
🎯 Exploit Status
Exploitation requires authenticated access but uses simple SQL injection techniques. Time-based blind SQL injection allows data extraction.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.4.0
Vendor Advisory: https://github.com/librenms/librenms/security/advisories/GHSA-cwx6-cx7x-4q34
Restart Required: No
Instructions:
1. Backup your LibreNMS installation and database. 2. Update to version 24.4.0 or later using your package manager or git pull. 3. Run ./daily.sh to update database schema if needed. 4. Verify the fix by checking version and testing the vulnerable endpoint.
🔧 Temporary Workarounds
Restrict Access to Search Endpoint
allBlock or restrict access to the vulnerable /search/search=packages endpoint via web server configuration or firewall rules.
# Apache: <Location "/search/search=packages"> Require all denied </Location>
# Nginx: location /search/search=packages { deny all; }
Remove Global Read Privileges
allReview and remove global read privileges from non-administrative users to limit attack surface.
# Check current privileges in LibreNMS admin panel
# Remove unnecessary global read permissions
🧯 If You Can't Patch
- Implement strict network segmentation to isolate LibreNMS from critical systems
- Enforce principle of least privilege by reviewing and minimizing user permissions
🔍 How to Verify
Check if Vulnerable:
Check LibreNMS version. If version is below 24.4.0, the system is vulnerable. Also verify if any users have global read privileges.Check Version:
cd /opt/librenms && git describe --tags 2>/dev/null || grep 'version' includes/vars.phpVerify Fix Applied:
After updating to 24.4.0+, verify version and test that SQL injection attempts on /search/search=packages endpoint no longer work.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests to /search/search=packages with SQL-like parameters
- Time-delayed responses from search endpoint
Network Indicators:
- POST requests to /search/search=packages with SQL injection payloads
- Unusual outbound database connections from web server
SIEM Query:
source="web_access.log" AND uri="/search/search=packages" AND (param="package" AND value MATCHES "(?i)(SELECT|UNION|SLEEP|WAITFOR|BENCHMARK)")🔗 References
- https://doc.clickup.com/9013166444/p/h/8ckm0bc-53/16811991bb5fff6
- https://github.com/librenms/librenms/commit/d29201fce134347f891102699fbde7070debee33
- https://github.com/librenms/librenms/security/advisories/GHSA-cwx6-cx7x-4q34
- https://doc.clickup.com/9013166444/p/h/8ckm0bc-53/16811991bb5fff6
- https://github.com/librenms/librenms/commit/d29201fce134347f891102699fbde7070debee33
- https://github.com/librenms/librenms/security/advisories/GHSA-cwx6-cx7x-4q34
