ghsa-x8gm-j36p-fppf
Vulnerability from github
Published
2024-10-01 22:27
Modified
2024-12-19 20:14
Severity ?
4.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1.8 (Low) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P
Summary
LibreNMS vulnerable to Stored Cross-site Scripting via File Upload
Details

Summary

Stored Cross-Site Scripting (XSS) can archive via Uploading a new Background for a Custom Map.

Details

Users with "admin" role can set background for a custom map, this allow the upload of SVG file that can contain XSS payload which will trigger onload. This led to Stored Cross-Site Scripting (XSS).

PoC

  1. Login using an Admin role account.

  2. Go over to "$URL/maps/custom", the Manage Custom Maps.

  3. Create a new map then choose to edit it.

  4. Choose the "Set Background" option.

  5. Choose to upload a SVG file that have this content. svg <svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"> <circle cx="50" cy="50" r="40" /> </svg>

  6. Once uploaded, there should be a link to the SVG return in the POST request to the API "$URL/maps/custom/1/background".

  7. Go over to that link on browser, should see a pop-up.

Impact

Attacker can use this to perform malicious java script code for malicious intent. This would impact other Admin role users and the Global Read role users. Normal users does not have permission to read the file, so they are not affected.

Show details on source website

To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "librenms/librenms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "24.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-47528"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-434",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-01T22:27:32Z",
    "nvd_published_at": "2024-10-01T21:15:08Z",
    "severity": "LOW"
  },
  "details": "### Summary\nStored Cross-Site Scripting (XSS) can archive via Uploading a new Background for a Custom Map.\n\n### Details\nUsers with \"admin\" role can set background for a custom map, this allow the upload of SVG file that can contain XSS payload which will trigger onload. This led to Stored Cross-Site Scripting (XSS).\n\n### PoC\n1. Login using an Admin role account.\n\n2. Go over to \"$URL/maps/custom\", the Manage Custom Maps.\n![image](https://github.com/user-attachments/assets/9d621532-7880-4010-b12d-efd377f0cfdd)\n\n3. Create a new map then choose to edit it.\n4. Choose the \"Set Background\" option.\n![image](https://github.com/user-attachments/assets/dc2e9453-ef3e-4649-a42f-60b7a2ad8189)\n\n5. Choose to upload a SVG file that have this content.\n```svg\n\u003csvg xmlns=\"http://www.w3.org/2000/svg\" onload=\"alert(document.domain)\"\u003e\n  \u003ccircle cx=\"50\" cy=\"50\" r=\"40\" /\u003e\n\u003c/svg\u003e\n```\n\n6. Once uploaded, there should be a link to the SVG return in the POST request to the API \"$URL/maps/custom/1/background\".\n![image](https://github.com/user-attachments/assets/dc224960-0bd3-42c9-ad49-2ec85b065939)\n\n7. Go over to that link on browser, should see a pop-up.\n![image](https://github.com/user-attachments/assets/47a7db14-bd89-48fe-885a-fd80a052115e)\n\n### Impact\nAttacker can use this to perform malicious java script code for malicious intent.\nThis would impact other Admin role users and the Global Read role users. Normal users does not have permission to read the file, so they are not affected.\n",
  "id": "GHSA-x8gm-j36p-fppf",
  "modified": "2024-12-19T20:14:29Z",
  "published": "2024-10-01T22:27:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/librenms/librenms/security/advisories/GHSA-x8gm-j36p-fppf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47528"
    },
    {
      "type": "WEB",
      "url": "https://github.com/librenms/librenms/commit/d959bf1b366319eda16e3cd6dfda8a22beb203be"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/librenms/librenms"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "LibreNMS vulnerable to Stored Cross-site Scripting via File Upload"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.