CVE-2024-47528
Improper Encoding or Escaping of Output (CWE-116)
Summary
LibreNMS, an open-source network monitoring system, contains a Stored Cross-Site Scripting (XSS) vulnerability. This vulnerability is present in the custom map background upload feature. Users with "admin" role can upload SVG files as backgrounds for custom maps, which can contain XSS payloads that will execute when the map is loaded.
Impact
This vulnerability allows attackers to inject malicious scripts into the LibreNMS application. When other users view the affected custom map, the malicious script will execute in their browser context. This can lead to various attacks such as stealing session cookies, capturing user input, or performing unauthorized actions on behalf of the victim. The impact is somewhat limited as it requires an attacker to have admin privileges to upload the malicious SVG file, but it can affect multiple users who view the compromised map.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. The vulnerability has been fixed in LibreNMS version 24.9.0.
Mitigation
1. Update LibreNMS to version 24.9.0 or later. 2. If immediate updating is not possible, restrict access to the custom map background upload feature to trusted administrators only. 3. Implement strict input validation and sanitization for all file uploads, especially for SVG files. 4. Consider implementing Content Security Policy (CSP) headers to mitigate the risk of XSS attacks. 5. Regularly audit user roles and permissions, ensuring the principle of least privilege is followed.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Timeline
NVD published the first details for CVE-2024-47528
Feedly found the first article mentioning CVE-2024-47528. See article
Feedly estimated the CVSS score as MEDIUM
EPSS Score was set to: 0.04% (Percentile: 9.6%)
A CVSS base score of 5.4 has been assigned.