CVE-2019-10665
LibreNMS Information Disclosure
Impact
An issue was discovered in LibreNMS through 1.47. The scripts that handle graphing options (`html/includes/graphs/common.inc.php` and `html/includes/graphs/graphs.inc.php`) do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with `mysqli_real_escape_string`, which is only useful for preventing SQL injection attacks; other parameters are unfiltered. This allows an attacker to inject RRDtool syntax with newline characters via the `html/graph.php` script. RRDtool syntax is quite versatile and an attacker could leverage this to perform a number of attacks, including disclosing directory structure and filenames, file content, denial of service, or writing arbitrary files.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | librenms/librenms | <= 1.47 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Librenms | Librenms | through 1.47 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://www.darkmatter.ae/xen1thlabs/librenms-rrdtool-injection-vulnerability-xl-19-023/
- https://github.com/advisories/GHSA-q5rg-wg7h-73m5
- https://nvd.nist.gov/vuln/detail/CVE-2019-10665
- https://www.darkmatter.ae/xen1thlabs/librenms-rrdtool-injection-vulnerability-xl-19-023