CVE-2024-50352

LibreNMS, an open-source PHP/MySQL/SNMP-based network monitoring system, contains a stored cross-site scripting flaw (CWE-79) in the Services section of the Device Overview page. An authenticated user who can add a service to a device can embed malicious JavaScript in the service 'name' parameter, which is stored and then executed whenever other users view that device's overview page. A successful attack runs attacker-controlled JavaScript in the context of another user's session, potentially compromising that account and enabling unauthorized actions with its privileges. All LibreNMS deployments running a version before 24.10.0 are affected. No exploitation is confirmed in the wild and the issue is not in CISA KEV, but a public advisory with a demonstration exists and EPSS assigns an elevated 37.6% probability of exploitation within 30 days.

What to do: Upgrade LibreNMS to 24.10.0 or later, which fixes the issue. Until patched, limit which accounts can add services, and review existing service names in the Services section for injected HTML/JavaScript. Because the payload fires when other users view the Device Overview page, prioritize instances where lower-privileged users can add services and higher-privileged users (e.g., admins) view them.