CVE-2024-47524
📋 TL;DR
This is a stored cross-site scripting (XSS) vulnerability in LibreNMS where administrators can inject malicious JavaScript into Device Group names. When other users view these groups, the JavaScript executes in their browsers. Only LibreNMS instances with admin users are affected.
💻 Affected Systems
- LibreNMS
📦 What is this software?
Librenms by Librenms
⚠️ Risk & Real-World Impact
Worst Case
Admin could steal session cookies, redirect users to malicious sites, or perform actions as other users, potentially leading to full system compromise.
Likely Case
Admin could perform session hijacking, deface pages, or steal credentials from other users viewing device groups.
If Mitigated
With proper input validation and output encoding, no impact beyond viewing unsanitized text.
🎯 Exploit Status
Exploitation requires admin privileges; trivial to execute once admin access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.9.0
Vendor Advisory: https://github.com/librenms/librenms/security/advisories/GHSA-fc38-2254-48g7
Restart Required: No
Instructions:
1. Backup your LibreNMS installation and database. 2. Update to version 24.9.0 or later via git: 'git pull origin master'. 3. Run database updates if needed: './daily.sh'. 4. Verify the fix by checking version.
🔧 Temporary Workarounds
Input Validation via Configuration
allImplement custom input validation for Device Group names to reject JavaScript code.
Not applicable - requires code modification
🧯 If You Can't Patch
- Restrict admin privileges to trusted users only and monitor admin activities.
- Implement web application firewall (WAF) rules to block XSS payloads in Device Group names.
🔍 How to Verify
Check if Vulnerable:
Check if LibreNMS version is below 24.9.0 using the version check command.Check Version:
grep 'version' /opt/librenms/LibreNMS/Version.php | grep -o "\d\+\.\d\+\.\d\+"Verify Fix Applied:
After updating, attempt to inject JavaScript into a Device Group name and verify it's properly sanitized when viewed.📡 Detection & Monitoring
Log Indicators:
- Unusual Device Group creation/modification by admin users
- Log entries showing JavaScript in Device Group names
Network Indicators:
- HTTP requests containing JavaScript payloads in Device Group parameters
SIEM Query:
source="librenms.log" AND ("Device Group" AND ("script" OR "javascript" OR "onerror"))