Executive brief
LibreNMS is a network monitoring and management platform used by organizations to track device health and network performance. An authenticated user with normal privileges can exploit a SQL injection vulnerability in the searchPhrase parameter to extract the entire database contents, potentially exposing sensitive network topology, device credentials, and monitoring data without administrative access.
Technical details
The vulnerability is a SQL injection in the searchPhrase parameter of the /ajax_table.php API endpoint, affecting multiple table processing includes. An authenticated remote attacker with normal user privileges can craft malicious input in the searchPhrase parameter to inject arbitrary SQL commands. The attack requires valid credentials but no special privileges, allowing extraction of all database contents. The vulnerability was patched in commit 32f72bc (July 10, 2020) which added input sanitization using parameterized queries to the affected parameters (searchPhrase, address, and sort).
Affected products
- LibreNMS LibreNMS 1.65 and earlier
Timeline
- 2020-09-13: disclosed
- 2020-07-10: patched: Fix committed to repository (github commit 32f72bc)