PT-2024-32641 · Librenms · Librenms

Minhnq1618 · Published 2024-10-01 · Updated 2024-12-19 · CVE-2024-47528

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 24.9.0

Description Stored Cross-Site Scripting (XSS) can be achieved by uploading a new Background for a Custom Map. Users with "admin" role can set background for a custom map, allowing the upload of SVG files that can contain XSS payloads, which will trigger on load. This leads to Stored Cross-Site Scripting (XSS). The issue affects admin role users and global read role users, as normal users do not have permission to read the file.

Recommendations For versions prior to 24.9.0, update to version 24.9.0 to resolve the issue. As a temporary workaround, consider restricting the upload of SVG files for custom map backgrounds or limiting the "admin" role's ability to set backgrounds until the update is applied. Avoid using the API endpoint "/maps/custom/1/background" for uploading SVG files until the issue is resolved.

Exploit

Fix

XSS

Unrestricted File Upload

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-79

CWE-434

CWE-116

Related Identifiers

CVE-2024-47528

GHSA-X8GM-J36P-FPPF

Affected Products

Librenms

References · 11

• 🔥 https://github.com/librenms/librenms/security/advisories/GHSA-x8gm-j36p-fppf · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47528.json · Exploit
• https://github.com/librenms/librenms/commit/d959bf1b366319eda16e3cd6dfda8a22beb203be · Patch
• https://osv.dev/vulnerability/CVE-2024-47528 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47528 · Security Note
• https://osv.dev/vulnerability/GHSA-x8gm-j36p-fppf · Vendor Advisory
• https://github.com/librenms/librenms · Note
• https://twitter.com/VulmonFeeds/status/1841254805294940654 · Twitter Post
• https://t.me/cvedetector/6791 · Telegram Post
• https://twitter.com/CVEnew/status/1841216373202247825 · Twitter Post
• https://t.me/cvenotify/105007 · Telegram Post