CVE-2024-50355
📋 TL;DR
This is a stored cross-site scripting (XSS) vulnerability in LibreNMS where administrators can inject malicious JavaScript into device display names. When other users view devices with these names, the script executes in their browsers. Only LibreNMS instances with admin users are affected.
💻 Affected Systems
- LibreNMS
📦 What is this software?
Librenms by Librenms
⚠️ Risk & Real-World Impact
Worst Case
Admin could steal session cookies, redirect users to malicious sites, or perform actions as other users, potentially leading to full account compromise.
Likely Case
Admin could perform limited client-side attacks against other users, such as session hijacking or phishing within the application.
If Mitigated
With proper input validation and output encoding, no impact beyond benign display name changes.
🎯 Exploit Status
Exploitation requires admin credentials; simple JavaScript injection in display name field.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.10.0
Vendor Advisory: https://github.com/librenms/librenms/security/advisories/GHSA-4m5r-w2rq-q54q
Restart Required: No
Instructions:
1. Backup your LibreNMS installation and database. 2. Update to version 24.10.0 or later using git: 'git pull origin master'. 3. Run database updates: './lnms migrate'. 4. Clear cache: './lnms config:clear'.
🔧 Temporary Workarounds
Input Validation via Web Server
linuxConfigure web server to block script tags in POST requests to device edit endpoints.
# For Apache: Use mod_security rules
# For Nginx: Use $request_body filtering
🧯 If You Can't Patch
- Restrict admin role permissions to trusted users only
- Implement Content Security Policy headers to limit script execution
🔍 How to Verify
Check if Vulnerable:
Check if LibreNMS version is below 24.10.0 and admin can edit device display names.Check Version:
cd /opt/librenms && git describe --tagsVerify Fix Applied:
After update, attempt to inject <script>alert('test')</script> in device display name - it should be sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual device name edits containing script tags
- Multiple device name changes by same admin
Network Indicators:
- POST requests to /device/ with script content in display_name parameter
SIEM Query:
source="librenms" AND (uri_path="/device/" AND method="POST" AND request_body LIKE "%<script>%")