Rook1337

**Nome do software vulnerável e versões afetadas** Versões do LibreNMS anteriores à 24.4.0 **Descrição** O problema está relacionado à sanitização inadequada do nome do modelo `Service`, o que pode levar a um ataque de Cross-site Scripting (XSS) armazenado. Isso pode ser explorado modificando-se o nome do modelo com código JavaScript malicioso, permitindo que um invasor execute código arbitrário quando o botão “Excluir” for clicado. A vulnerabilidade pode levar ao roubo de cookies ou à execução de outras funcionalidades por um invasor usando essa exploração. **Recomendações** Para versões anteriores à 24.4.0, atualize para a versão 24.4.0 para corrigir a vulnerabilidade. Como solução temporária, considere restringir o acesso ao campo de nome do modelo `Service` para minimizar o risco de exploração. Além disso, evite usar o campo de nome do modelo `Service` até que o problema seja resolvido.

**Name of the Vulnerable Software and Affected Versions** LibreNMS versions prior to 23.11.0 **Description** The issue allows a low-privilege user to enumerate devices on LibreNMS with their id or hostname by accessing a request sent to `graph.php` when they access their device dashboard. This enables the low-privilege user to see all devices registered by admin users. **Recommendations** For versions prior to 23.11.0, upgrade to release version 23.11.0 or later to address the vulnerability. As a temporary workaround, consider implementing privilege access control features to check if low-privilege users have access to specific devices or not. Restrict access to the `graph.php` endpoint to minimize the risk of exploitation. Avoid using the `device` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** LibreNMS versions prior to 23.11.0 **Description** The issue is a cross-site scripting (XSS) vulnerability in the device group popups. This occurs when the application does not properly sanitize inputs, allowing an attacker to execute malicious JavaScript code. The vulnerability can be exploited by creating a device group with a malicious name, such as `"><img src=x onerror=alert(1);>`, and then deleting the device group, which triggers the XSS payload. The estimated number of potentially affected devices is not provided. There are no known real-world incidents where this issue was exploited. **Recommendations** For LibreNMS versions prior to 23.11.0, upgrade to release version 23.11.0 or later to address the vulnerability. As a temporary workaround, consider restricting access to the device group popups until the issue is resolved. Avoid using unsanitized input in the device group names to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LibreNMS versions prior to 23.11.0 **Description** The issue concerns the login method in LibreNMS, which lacks a rate limit, allowing an attacker to potentially gain access to user accounts through brute force attacks. The login method uses a GET request for authentication, which is not recommended as it may store user credentials in web server logs. There are no known workarounds for this issue. **Recommendations** For versions prior to 23.11.0, upgrade to version 23.11.0 to address the issue. As a temporary workaround, consider restricting access to the login endpoint or implementing rate limiting on the `/` endpoint to minimize the risk of exploitation. Avoid using the `password` parameter in the affected API endpoint until the issue is resolved.