CVE-2024-51496
📋 TL;DR
This is a reflected cross-site scripting (XSS) vulnerability in LibreNMS that allows attackers to inject malicious JavaScript via the 'metric' parameter in wireless and health endpoints. When exploited, it can compromise user sessions and enable unauthorized actions. All LibreNMS users with vulnerable versions are affected.
💻 Affected Systems
- LibreNMS
📦 What is this software?
Librenms by Librenms
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal admin session cookies, gain full administrative access to LibreNMS, and potentially compromise the entire monitoring system and monitored network devices.
Likely Case
Attackers steal user session cookies to impersonate legitimate users, perform unauthorized actions within LibreNMS, and potentially pivot to other systems.
If Mitigated
Limited impact due to proper input validation, output encoding, and Content Security Policy (CSP) headers preventing script execution.
🎯 Exploit Status
Simple reflected XSS requiring user to click malicious link. No authentication needed to trigger vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.10.0
Vendor Advisory: https://github.com/librenms/librenms/security/advisories/GHSA-28p7-f6h6-3jh3
Restart Required: No
Instructions:
1. Backup your LibreNMS installation and database. 2. Update to version 24.10.0 or later using git: 'git pull origin master'. 3. Run database updates: './lnms migrate'. 4. Clear cache: './lnms config:cache:clear'.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation for metric parameter to reject malicious payloads
Modify LibreNMS source code to validate metric parameter values
Web Application Firewall (WAF)
allConfigure WAF rules to block XSS payloads in URL parameters
Add XSS detection rules to your WAF configuration
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to prevent script execution
- Use web application firewall to filter malicious metric parameter values
🔍 How to Verify
Check if Vulnerable:
Test by accessing /wireless?metric=<script>alert('test')</script> and checking if script executesCheck Version:
cd /opt/librenms && git describe --tagsVerify Fix Applied:
After update, test same payload - should see encoded output instead of script execution📡 Detection & Monitoring
Log Indicators:
- HTTP requests with suspicious metric parameter values containing script tags or JavaScript
Network Indicators:
- Unusual requests to /wireless or /health endpoints with encoded payloads
SIEM Query:
source="librenms_access.log" AND (uri_path="/wireless" OR uri_path="/health") AND query_string="*metric=*script*"