PT-2019-11978 · Librenms · Librenms
Published
2019-09-09
·
Updated
2022-05-24
·
CVE-2019-10665
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
LibreNMS versions 1.47 and earlier
Description
The issue arises from insufficient validation or encoding of user-supplied input in the scripts handling graphing options, specifically in
html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php. Some parameters are filtered with mysqli real escape string, which only prevents SQL injection attacks, while others remain unfiltered. This allows an attacker to inject RRDtool syntax with newline characters via the html/graph.php script. RRDtool syntax is versatile, enabling attacks such as disclosing directory structure and filenames, file content, denial of service, or writing arbitrary files.Recommendations
For LibreNMS versions 1.47 and earlier, consider disabling the graphing functionality temporarily until a patch is available. Restrict access to the
html/graph.php script and the html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php files to minimize the risk of exploitation. Avoid using unfiltered parameters in the affected scripts until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Librenms