Minhnq1618

Name of the Vulnerable Software and Affected Versions: LibreNMS versions prior to 24.10.0 Description: The application fails to properly sanitize user input, allowing an attacker to execute malicious JavaScript code. This issue occurs when a user with an Admin role adds Notes to a device and the ExamplePlugin is enabled. If JavaScript code is inside the device's Notes, it will be triggered. This could allow authenticated users to execute arbitrary JavaScript code in the context of other users' sessions, potentially compromising accounts and enabling unauthorized actions. Recommendations: For versions prior to 24.10.0, update to version 24.10.0 or later to resolve the issue. As a temporary workaround, consider disabling the ExamplePlugin until a patch is available. Restrict access to the Notes feature for users with Admin roles to minimize the risk of exploitation. Avoid using the Notes feature in the device settings until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: LibreNMS versions prior to 24.10.0 Description: The application fails to properly sanitize user input in the device Display Name, allowing an attacker to execute malicious JavaScript code. This can be triggered from different sources, including the Manage Access page, Alert Rules, Alerts Notifications, Alert History, Event Log, Outages function, and the dashboard. The impact of this issue could allow authenticated users to execute arbitrary JavaScript code in the context of other users' sessions, potentially compromising user accounts and enabling unauthorized actions. Recommendations: For versions prior to 24.10.0, update to version 24.10.0 or later to fix the vulnerability. As a temporary workaround, consider restricting access to the device Display Name field for users with Admin roles until the update is applied. Additionally, avoid using JavaScript code in the device Display Name to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LibreNMS versions prior to 24.9.0 **Description** The application fails to properly sanitize user input in the Device Groups name, allowing an attacker to execute malicious JavaScript code when a user views the details of the Device Group. This can be exploited by creating a new Device Group with malicious JavaScript code in its name. For example, using the `onerror` attribute in an `img` tag, such as `<img src="x" onerror="alert(document.cookie)">`, can trigger the execution of the malicious code when the Device Group details are viewed. This issue can impact all users who have access to the detail page of the device group, as anyone can potentially execute malicious JavaScript code. **Recommendations** For versions prior to 24.9.0, update to version 24.9.0 or later to fix the vulnerability. As a temporary workaround, consider restricting access to the Device Groups feature for non-admin users and avoiding the use of user-inputted data in the Device Groups name until the issue is resolved. Additionally, disabling JavaScript execution in the browser when viewing Device Group details can help mitigate the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LibreNMS versions prior to 24.9.0 **Description** Stored Cross-Site Scripting (XSS) can be achieved by uploading a new Background for a Custom Map. Users with "admin" role can set background for a custom map, allowing the upload of SVG files that can contain XSS payloads, which will trigger on load. This leads to Stored Cross-Site Scripting (XSS). The issue affects admin role users and global read role users, as normal users do not have permission to read the file. **Recommendations** For versions prior to 24.9.0, update to version 24.9.0 to resolve the issue. As a temporary workaround, consider restricting the upload of SVG files for custom map backgrounds or limiting the "admin" role's ability to set backgrounds until the update is applied. Avoid using the API endpoint "/maps/custom/1/background" for uploading SVG files until the issue is resolved.