Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS14OGdtLWozNnAtZnBwZs4AA_6E

LibreNMS vulnerable to Stored Cross-site Scripting via File Upload

Summary

Stored Cross-Site Scripting (XSS) can archive via Uploading a new Background for a Custom Map.

Details

Users with "admin" role can set background for a custom map, this allow the upload of SVG file that can contain XSS payload which will trigger onload. This led to Stored Cross-Site Scripting (XSS).

PoC

  1. Login using an Admin role account.

  2. Go over to "$URL/maps/custom", the Manage Custom Maps.
    image

  3. Create a new map then choose to edit it.

  4. Choose the "Set Background" option.
    image

  5. Choose to upload a SVG file that have this content.

<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)">
  <circle cx="50" cy="50" r="40" />
</svg>

  1. Once uploaded, there should be a link to the SVG return in the POST request to the API "$URL/maps/custom/1/background".
    image

  2. Go over to that link on browser, should see a pop-up.
    image

Impact

Attacker can use this to perform malicious java script code for malicious intent.
This would impact other Admin role users and the Global Read role users. Normal users does not have permission to read the file, so they are not affected.

Permalink: https://github.com/advisories/GHSA-x8gm-j36p-fppf
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14OGdtLWozNnAtZnBwZs4AA_6E
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: 20 days ago
Updated: 20 days ago


CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-x8gm-j36p-fppf, CVE-2024-47528
References: Repository: https://github.com/librenms/librenms
Blast Radius: 1.8

Affected Packages

packagist:librenms/librenms
Dependent packages: 1
Dependent repositories: 2
Downloads: 51,107 total
Affected Version Ranges: < 24.9.0
Fixed in: 24.9.0
All affected versions: 1.20.1, 1.22.1, 1.30.1, 1.31.1, 1.31.2, 1.31.3, 1.32.1, 1.33.1, 1.36.1, 1.42.1, 1.48.1, 1.50.1, 1.53.1, 1.58.1, 1.62.1, 1.62.2, 1.64.1, 1.65.1, 1.70.0, 1.70.1, 21.1.0, 21.2.0, 21.3.0, 21.4.0, 21.5.0, 21.5.1, 21.6.0, 21.7.0, 21.8.0, 21.9.0, 21.9.1, 21.10.0, 21.10.1, 21.10.2, 21.11.0, 21.12.0, 21.12.1, 22.1.0, 22.2.0, 22.2.1, 22.2.2, 22.3.0, 22.4.0, 22.4.1, 22.5.0, 22.6.0, 22.7.0, 22.8.0, 22.9.0, 22.10.0, 22.11.0, 22.12.0, 23.1.0, 23.1.1, 23.2.0, 23.4.0, 23.4.1, 23.5.0, 23.6.0, 23.7.0, 23.8.0, 23.8.1, 23.8.2, 23.9.0, 23.9.1, 23.10.0, 23.11.0, 24.1.0, 24.2.0, 24.3.0, 24.4.0, 24.4.1, 24.5.0, 24.6.0, 24.7.0, 24.8.0, 24.8.1
All unaffected versions: 24.9.0, 24.9.1