cvelistv5 - cve-2024-47523

CVE-2024-47523 (GCVE-0-2024-47523)

Vulnerability from cvelistv5 – Published: 2024-10-01 20:31 – Updated: 2024-10-02 12:58

Summary

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Transports" feature allows authenticated users to inject arbitrary JavaScript through the "Details" section (which contains multiple fields depending on which transport is selected at that moment). This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions. This vulnerability is fixed in 24.9.0.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/librenms/librenms/security/adv…	x_refsource_CONFIRM
	https://github.com/librenms/librenms/commit/ee1af…	x_refsource_MISC
	https://github.com/librenms/librenms/blob/4777247…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	librenms	librenms	Affected: < 24.9.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "librenms",
            "vendor": "librenms",
            "versions": [
              {
                "lessThan": "24.9.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47523",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-02T12:57:21.841644Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-02T12:58:32.857Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "librenms",
          "vendor": "librenms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 24.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the \"Alert Transports\" feature allows authenticated users to inject arbitrary JavaScript through the \"Details\" section (which contains multiple fields depending on which transport is selected at that moment). This vulnerability can lead to the execution of malicious code in the context of other users\u0027 sessions, potentially compromising their accounts and allowing unauthorized actions. This vulnerability is fixed in 24.9.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-01T20:31:59.230Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/librenms/librenms/security/advisories/GHSA-7f84-28qh-9486",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/librenms/librenms/security/advisories/GHSA-7f84-28qh-9486"
        },
        {
          "name": "https://github.com/librenms/librenms/commit/ee1afba003d33667981e098c83295f599d88439c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/librenms/librenms/commit/ee1afba003d33667981e098c83295f599d88439c"
        },
        {
          "name": "https://github.com/librenms/librenms/blob/4777247327c793ed0a3306d0464b95176008177b/includes/html/print-alert-transports.php#L40",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/librenms/librenms/blob/4777247327c793ed0a3306d0464b95176008177b/includes/html/print-alert-transports.php#L40"
        }
      ],
      "source": {
        "advisory": "GHSA-7f84-28qh-9486",
        "discovery": "UNKNOWN"
      },
      "title": "LibreNMS has Stored Cross-site Scripting vulnerability in \"Alert Transports\" feature"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47523",
    "datePublished": "2024-10-01T20:31:59.230Z",
    "dateReserved": "2024-09-25T21:46:10.928Z",
    "dateUpdated": "2024-10-02T12:58:32.857Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"24.9.0\", \"matchCriteriaId\": \"E39B6DE8-DAD4-4158-B2BF-93B804AE09FF\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the \\\"Alert Transports\\\" feature allows authenticated users to inject arbitrary JavaScript through the \\\"Details\\\" section (which contains multiple fields depending on which transport is selected at that moment). This vulnerability can lead to the execution of malicious code in the context of other users\u0027 sessions, potentially compromising their accounts and allowing unauthorized actions. This vulnerability is fixed in 24.9.0.\"}, {\"lang\": \"es\", \"value\": \"LibreNMS es un sistema de monitoreo de red de c\\u00f3digo abierto basado en PHP/MySQL/SNMP. Una vulnerabilidad de tipo Cross-Site Scripting (XSS) Almacenado en la funci\\u00f3n \\\"Alert Transports\\\" permite a los usuarios autenticados inyectar c\\u00f3digo JavaScript arbitrario a trav\\u00e9s de la secci\\u00f3n \\\"Detalles\\\" (que contiene varios campos seg\\u00fan el transporte seleccionado en ese momento). Esta vulnerabilidad puede provocar la ejecuci\\u00f3n de c\\u00f3digo malicioso en el contexto de las sesiones de otros usuarios, lo que podr\\u00eda comprometer sus cuentas y permitir acciones no autorizadas. Esta vulnerabilidad se ha corregido en la versi\\u00f3n 24.9.0.\"}]",
      "id": "CVE-2024-47523",
      "lastModified": "2024-10-07T19:07:30.287",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 1.7, \"impactScore\": 5.3}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\", \"baseScore\": 5.4, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.3, \"impactScore\": 2.7}]}",
      "published": "2024-10-01T21:15:07.050",
      "references": "[{\"url\": \"https://github.com/librenms/librenms/blob/4777247327c793ed0a3306d0464b95176008177b/includes/html/print-alert-transports.php#L40\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Product\"]}, {\"url\": \"https://github.com/librenms/librenms/commit/ee1afba003d33667981e098c83295f599d88439c\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/librenms/librenms/security/advisories/GHSA-7f84-28qh-9486\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Exploit\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47523\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-10-01T21:15:07.050\",\"lastModified\":\"2024-10-07T19:07:30.287\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the \\\"Alert Transports\\\" feature allows authenticated users to inject arbitrary JavaScript through the \\\"Details\\\" section (which contains multiple fields depending on which transport is selected at that moment). This vulnerability can lead to the execution of malicious code in the context of other users\u0027 sessions, potentially compromising their accounts and allowing unauthorized actions. This vulnerability is fixed in 24.9.0.\"},{\"lang\":\"es\",\"value\":\"LibreNMS es un sistema de monitoreo de red de c\u00f3digo abierto basado en PHP/MySQL/SNMP. Una vulnerabilidad de tipo Cross-Site Scripting (XSS) Almacenado en la funci\u00f3n \\\"Alert Transports\\\" permite a los usuarios autenticados inyectar c\u00f3digo JavaScript arbitrario a trav\u00e9s de la secci\u00f3n \\\"Detalles\\\" (que contiene varios campos seg\u00fan el transporte seleccionado en ese momento). Esta vulnerabilidad puede provocar la ejecuci\u00f3n de c\u00f3digo malicioso en el contexto de las sesiones de otros usuarios, lo que podr\u00eda comprometer sus cuentas y permitir acciones no autorizadas. Esta vulnerabilidad se ha corregido en la versi\u00f3n 24.9.0.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.7,\"impactScore\":5.3},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"24.9.0\",\"matchCriteriaId\":\"E39B6DE8-DAD4-4158-B2BF-93B804AE09FF\"}]}]}],\"references\":[{\"url\":\"https://github.com/librenms/librenms/blob/4777247327c793ed0a3306d0464b95176008177b/includes/html/print-alert-transports.php#L40\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\"]},{\"url\":\"https://github.com/librenms/librenms/commit/ee1afba003d33667981e098c83295f599d88439c\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/librenms/librenms/security/advisories/GHSA-7f84-28qh-9486\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47523\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-02T12:57:21.841644Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*\"], \"vendor\": \"librenms\", \"product\": \"librenms\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"24.9.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-02T12:58:28.471Z\"}}], \"cna\": {\"title\": \"LibreNMS has Stored Cross-site Scripting vulnerability in \\\"Alert Transports\\\" feature\", \"source\": {\"advisory\": \"GHSA-7f84-28qh-9486\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"librenms\", \"product\": \"librenms\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 24.9.0\"}]}], \"references\": [{\"url\": \"https://github.com/librenms/librenms/security/advisories/GHSA-7f84-28qh-9486\", \"name\": \"https://github.com/librenms/librenms/security/advisories/GHSA-7f84-28qh-9486\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/librenms/librenms/commit/ee1afba003d33667981e098c83295f599d88439c\", \"name\": \"https://github.com/librenms/librenms/commit/ee1afba003d33667981e098c83295f599d88439c\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/librenms/librenms/blob/4777247327c793ed0a3306d0464b95176008177b/includes/html/print-alert-transports.php#L40\", \"name\": \"https://github.com/librenms/librenms/blob/4777247327c793ed0a3306d0464b95176008177b/includes/html/print-alert-transports.php#L40\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the \\\"Alert Transports\\\" feature allows authenticated users to inject arbitrary JavaScript through the \\\"Details\\\" section (which contains multiple fields depending on which transport is selected at that moment). This vulnerability can lead to the execution of malicious code in the context of other users\u0027 sessions, potentially compromising their accounts and allowing unauthorized actions. This vulnerability is fixed in 24.9.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-10-01T20:31:59.230Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47523\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-10-02T12:58:32.857Z\", \"dateReserved\": \"2024-09-25T21:46:10.928Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-10-01T20:31:59.230Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-47523

Vulnerability from fkie_nvd - Published: 2024-10-01 21:15 - Updated: 2024-10-07 19:07

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/librenms/librenms/blob/4777247327c793ed0a3306d0464b95176008177b/includes/html/print-alert-transports.php#L40	Product
security-advisories@github.com	https://github.com/librenms/librenms/commit/ee1afba003d33667981e098c83295f599d88439c	Patch
security-advisories@github.com	https://github.com/librenms/librenms/security/advisories/GHSA-7f84-28qh-9486	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	librenms	librenms	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E39B6DE8-DAD4-4158-B2BF-93B804AE09FF",
              "versionEndExcluding": "24.9.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the \"Alert Transports\" feature allows authenticated users to inject arbitrary JavaScript through the \"Details\" section (which contains multiple fields depending on which transport is selected at that moment). This vulnerability can lead to the execution of malicious code in the context of other users\u0027 sessions, potentially compromising their accounts and allowing unauthorized actions. This vulnerability is fixed in 24.9.0."
    },
    {
      "lang": "es",
      "value": "LibreNMS es un sistema de monitoreo de red de c\u00f3digo abierto basado en PHP/MySQL/SNMP. Una vulnerabilidad de tipo Cross-Site Scripting (XSS) Almacenado en la funci\u00f3n \"Alert Transports\" permite a los usuarios autenticados inyectar c\u00f3digo JavaScript arbitrario a trav\u00e9s de la secci\u00f3n \"Detalles\" (que contiene varios campos seg\u00fan el transporte seleccionado en ese momento). Esta vulnerabilidad puede provocar la ejecuci\u00f3n de c\u00f3digo malicioso en el contexto de las sesiones de otros usuarios, lo que podr\u00eda comprometer sus cuentas y permitir acciones no autorizadas. Esta vulnerabilidad se ha corregido en la versi\u00f3n 24.9.0."
    }
  ],
  "id": "CVE-2024-47523",
  "lastModified": "2024-10-07T19:07:30.287",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.7,
        "impactScore": 5.3,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-10-01T21:15:07.050",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/librenms/librenms/blob/4777247327c793ed0a3306d0464b95176008177b/includes/html/print-alert-transports.php#L40"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/librenms/librenms/commit/ee1afba003d33667981e098c83295f599d88439c"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/librenms/librenms/security/advisories/GHSA-7f84-28qh-9486"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-7F84-28QH-9486

Vulnerability from github – Published: 2024-10-01 20:31 – Updated: 2024-10-01 21:53

Summary

LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Transports" feature

Details

Summary

A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Transports" feature allows authenticated users to inject arbitrary JavaScript through the "Details" section (which contains multiple fields depending on which transport is selected at that moment). This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions.

Details

The vulnerability occurs when creating an alert transport. The application does not properly sanitize the user input in the "Details" field, allowing an attacker to inject and store arbitrary JavaScript. This script is then executed in the context of the page whenever the alert transport is viewed or processed.

For instance, the following payload can be used to trigger the XSS: test1<script>{onerror=alert}throw 1337</script>

When the page containing the transport details is loaded, this payload causes the browser to execute the injected script, which in this case triggers an alert popup.

The root cause of the vulnerability is that the application does not sanitize the value of $instance->displayDetails before appending it to the HTML output. This is demonstrated in the following code: https://github.com/librenms/librenms/blob/4777247327c793ed0a3306d0464b95176008177b/includes/html/print-alert-transports.php#L40

PoC

Create a new alert transport in the LibreNMS interface.
Depending on the transport chosen, just input the following payload in any field that ends up in the "Details" section: test1<script>{onerror=alert}throw 1337</script>
Save the transport and trigger the alert.
When the transport details are accessed, the injected script executes, displaying an alert popup.

Example Request:

POST /ajax_form.php HTTP/1.1
Host: <your_host>
X-Requested-With: XMLHttpRequest
X-CSRF-TOKEN: <your_XSRF_token>
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: <your_cookie>

_token=<your_token>&transport_id=2&type=alert-transports&name=Test1&transport-choice=canopsis-form&_token=Ep6belaqXe5qE301CGmtoOWJ71gvRfBXjRyhXEpH&transport-type=canopsis&canopsis-host=localhost%3Cscript%3E%7Bonerror%3Dalert%7Dthrow+1337%3C%2Fscript%3E&canopsis-port=5000&canopsis-user=%3Cscript%3E%7Bonerror%3Dalert%7Dthrow+1337%3C%2Fscript%3E&canopsis-pass=%3Cscript%3E%7Bonerror%3Dalert%7Dthrow+1337%3C%2Fscript%3E&canopsis-vhost=%3Cscript%3E%7Bonerror%3Dalert%7Dthrow+1337%3C%2Fscript%3E

Impact

It could allow authenticated users to execute arbitrary JavaScript code in the context of other users' sessions. Impacted users could have their accounts compromised, enabling the attacker to perform unauthorized actions on their behalf.

Severity ?

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L

5.2 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "librenms/librenms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "24.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-47523"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-01T20:31:22Z",
    "nvd_published_at": "2024-10-01T21:15:07Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nA Stored Cross-Site Scripting (XSS) vulnerability in the \"Alert Transports\" feature allows authenticated users to inject arbitrary JavaScript through the \"Details\" section (which contains multiple fields depending on which transport is selected at that moment). This vulnerability can lead to the execution of malicious code in the context of other users\u0027 sessions, potentially compromising their accounts and allowing unauthorized actions.\n\n### Details\nThe vulnerability occurs when creating an alert transport. The application does not properly sanitize the user input in the \"Details\" field, allowing an attacker to inject and store arbitrary JavaScript. This script is then executed in the context of the page whenever the alert transport is viewed or processed.\n\nFor instance, the following payload can be used to trigger the XSS:\n```test1\u003cscript\u003e{onerror=alert}throw 1337\u003c/script\u003e```\n\nWhen the page containing the transport details is loaded, this payload causes the browser to execute the injected script, which in this case triggers an alert popup.\n\nThe root cause of the vulnerability is that the application does not sanitize the value of $instance-\u003edisplayDetails before appending it to the HTML output. This is demonstrated in the following code:\nhttps://github.com/librenms/librenms/blob/4777247327c793ed0a3306d0464b95176008177b/includes/html/print-alert-transports.php#L40\n\n### PoC\n1. Create a new alert transport in the LibreNMS interface.\n2. Depending on the transport chosen, just input the following payload in any field that ends up in the \"Details\" section:\n```test1\u003cscript\u003e{onerror=alert}throw 1337\u003c/script\u003e```\n3. Save the transport and trigger the alert.\n4. When the transport details are accessed, the injected script executes, displaying an alert popup.\n\nExample Request:\n\n```http\nPOST /ajax_form.php HTTP/1.1\nHost: \u003cyour_host\u003e\nX-Requested-With: XMLHttpRequest\nX-CSRF-TOKEN: \u003cyour_XSRF_token\u003e\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nCookie: \u003cyour_cookie\u003e\n\n_token=\u003cyour_token\u003e\u0026transport_id=2\u0026type=alert-transports\u0026name=Test1\u0026transport-choice=canopsis-form\u0026_token=Ep6belaqXe5qE301CGmtoOWJ71gvRfBXjRyhXEpH\u0026transport-type=canopsis\u0026canopsis-host=localhost%3Cscript%3E%7Bonerror%3Dalert%7Dthrow+1337%3C%2Fscript%3E\u0026canopsis-port=5000\u0026canopsis-user=%3Cscript%3E%7Bonerror%3Dalert%7Dthrow+1337%3C%2Fscript%3E\u0026canopsis-pass=%3Cscript%3E%7Bonerror%3Dalert%7Dthrow+1337%3C%2Fscript%3E\u0026canopsis-vhost=%3Cscript%3E%7Bonerror%3Dalert%7Dthrow+1337%3C%2Fscript%3E\n```\n\n### Impact\nIt could allow authenticated users to execute arbitrary JavaScript code in the context of other users\u0027 sessions. Impacted users could have their accounts compromised, enabling the attacker to perform unauthorized actions on their behalf.\n",
  "id": "GHSA-7f84-28qh-9486",
  "modified": "2024-10-01T21:53:05Z",
  "published": "2024-10-01T20:31:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/librenms/librenms/security/advisories/GHSA-7f84-28qh-9486"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47523"
    },
    {
      "type": "WEB",
      "url": "https://github.com/librenms/librenms/commit/ee1afba003d33667981e098c83295f599d88439c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/librenms/librenms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/librenms/librenms/blob/4777247327c793ed0a3306d0464b95176008177b/includes/html/print-alert-transports.php#L40"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "LibreNMS has Stored Cross-site Scripting vulnerability in \"Alert Transports\" feature"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-47523 (GCVE-0-2024-47523)

FKIE_CVE-2024-47523

GHSA-7F84-28QH-9486

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature