CVE-2024-47527
📋 TL;DR
This stored XSS vulnerability in LibreNMS allows authenticated users to inject malicious JavaScript through device names in the Device Dependencies feature. When other users view affected pages, the malicious code executes in their session context, potentially compromising their accounts. All LibreNMS instances with vulnerable versions are affected.
💻 Affected Systems
- LibreNMS
📦 What is this software?
Librenms by Librenms
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains administrative privileges, modifies system configurations, steals sensitive data, or deploys ransomware across monitored infrastructure.
Likely Case
Attackers hijack user sessions to perform unauthorized actions, steal credentials, or pivot to other systems in the network.
If Mitigated
With proper input validation and output encoding, the attack is prevented, though the vulnerability still exists in the codebase.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.9.0
Vendor Advisory: https://github.com/librenms/librenms/security/advisories/GHSA-rwwc-2v8q-gc9v
Restart Required: No
Instructions:
1. Backup your LibreNMS installation and database. 2. Update LibreNMS to version 24.9.0 or later using your preferred method (git pull, package manager, or manual update). 3. Verify the update completed successfully.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to sanitize device names before storage.
Modify LibreNMS source code to add HTML entity encoding for the hostname parameter in device dependency handling.
🧯 If You Can't Patch
- Restrict user permissions to limit who can modify device dependencies.
- Implement a web application firewall (WAF) with XSS protection rules.
🔍 How to Verify
Check if Vulnerable:
Check if your LibreNMS version is below 24.9.0 by visiting the web interface or checking the installation directory.Check Version:
cd /opt/librenms && ./lnms --versionVerify Fix Applied:
After updating, confirm the version is 24.9.0 or higher and test device name input for XSS payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual device name entries containing script tags or JavaScript code in database logs or application logs.
Network Indicators:
- HTTP requests with suspicious payloads in device name parameters to LibreNMS endpoints.
SIEM Query:
source="librenms_access.log" AND (uri="/ajax_form.php" OR uri="/device-dependencies") AND (message="*<script>*" OR message="*javascript:*")