PT-2023-30180 · Librenms · Librenms

Rook1337 · Published 2023-11-08 · Updated 2023-11-25 · CVE-2023-46745

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 23.11.0

Description The issue concerns the login method in LibreNMS, which lacks a rate limit, allowing an attacker to potentially gain access to user accounts through brute force attacks. The login method uses a GET request for authentication, which is not recommended as it may store user credentials in web server logs. There are no known workarounds for this issue.

Recommendations For versions prior to 23.11.0, upgrade to version 23.11.0 to address the issue. As a temporary workaround, consider restricting access to the login endpoint or implementing rate limiting on the / endpoint to minimize the risk of exploitation. Avoid using the password parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Allocation of Resources Without Limits

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-770

CWE-307

Related Identifiers

CVE-2023-46745

GHSA-RQ42-58QF-V3QX

Affected Products

Librenms

References · 13

• 🔥 https://github.com/librenms/librenms/security/advisories/GHSA-rq42-58qf-v3qx · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46745.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-46745 · Security Note
• https://osv.dev/vulnerability/GHSA-rq42-58qf-v3qx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-46745 · Vendor Advisory
• https://github.com/librenms/librenms · Note
• https://github.com/librenms/librenms/pull/15558 · Note
• https://github.com/librenms/librenms/releases/tag/23.11.0 · Note
• https://github.com/librenms/librenms/commit/7c006e96251ae1d32e1a015b361a7bfbb815c028 · Note
• https://twitter.com/imrook1337/status/1722286300802551934 · Twitter Post
• https://t.me/cvenotify/61139 · Telegram Post
• https://t.me/cvenotify/60642 · Telegram Post
• https://t.me/cvenotify/60685 · Telegram Post