Executive brief
LibreNMS is a popular open-source network monitoring and management system. A vulnerability in version 1.65 allows authenticated users with normal privileges to inject SQL code through the sort parameter of the API endpoint, bypassing input validation and potentially exposing the entire database contents including sensitive network device information, credentials, and monitoring data.
Technical details
A SQL injection vulnerability exists in LibreNMS 1.65 within the /ajax_table.php API endpoint, specifically in the sort parameter processing. The vulnerability affects at least 23 table include files in the includes/html/table directory including address-search, alertlog, arp-search, bills, device inventory, and sensors. The vulnerable code fails to properly sanitize user-supplied input in the sort parameter before including it in SQL queries. An authenticated attacker with normal user privileges can craft malicious SQL syntax in the sort parameter to extract arbitrary data from the LibreNMS database. The fix was implemented in version 1.65.1 (committed July 10, 2020) by properly escaping and validating the sort parameter.
Affected products
- LibreNMS LibreNMS 1.65
Timeline
- 2020-07-10: disclosed
- 2020-07-10: patched