Summary
LibreNMS contains an SQL injection vulnerability in notification handling when an unprivileged user supplies an array-valued notification identifier. Successful exploitation may allow cross-table access to sensitive data, including password hashes, with query results persisted and exposed through the application interface.
LibreNMS contains an SQL injection vulnerability in notification handling when an unprivileged user supplies an array-valued notification identifier. Successful exploitation may allow cross-table access to sensitive data, including password hashes, with query results persisted and exposed through the application interface.
Affected context
The issue occurs in LibreNMS notification processing when the notification_id parameter is accepted in an unexpected array form and incorporated into database operations without sufficient query safety. Deployments are at risk when unprivileged users can reach the affected notification endpoint and the application stores or displays resulting data through notification attributes.
The issue occurs in LibreNMS notification processing when the notification_id parameter is accepted in an unexpected array form and incorporated into database operations without sufficient query safety. Deployments are at risk when unprivileged users can reach the affected notification endpoint and the application stores or displays resulting data through notification attributes.
Exploit preconditions
- Attack surface: The LibreNMS notification handling endpoint associated with
notifications.inc.php - Required access: An authenticated account or other unprivileged access capable of submitting notification parameters
- Trigger point: Processing an array-valued
notification_idparameter - Why exploitation is possible: User-controlled input reaches SQL operations without adequate parameterization or type enforcement, allowing query behavior to be altered and results to be persisted
- Attack surface: The LibreNMS notification handling endpoint associated with
notifications.inc.php - Required access: An authenticated account or other unprivileged access capable of submitting notification parameters
- Trigger point: Processing an array-valued
notification_idparameter - Why exploitation is possible: User-controlled input reaches SQL operations without adequate parameterization or type enforcement, allowing query behavior to be altered and results to be persisted
Why this happens
The underlying flaw is insufficient separation between user-supplied parameter data and SQL syntax. Accepting an array where a scalar identifier is expected, then incorporating that value into a database query without strict type validation and parameterized handling, creates a CWE-89: SQL Injection condition. The resulting query may access data outside the intended notification scope.
The underlying flaw is insufficient separation between user-supplied parameter data and SQL syntax. Accepting an array where a scalar identifier is expected, then incorporating that value into a database query without strict type validation and parameterized handling, creates a CWE-89: SQL Injection condition. The resulting query may access data outside the intended notification scope.
Potential impact
- Attackers may read unauthorized database records
- Password hashes and other sensitive account data could be disclosed
- Query results may be persisted in notification-related records
- Sensitive data could become accessible through the LibreNMS interface
- Database integrity may be affected if additional unauthorized operations are possible
- Attackers may read unauthorized database records
- Password hashes and other sensitive account data could be disclosed
- Query results may be persisted in notification-related records
- Sensitive data could become accessible through the LibreNMS interface
- Database integrity may be affected if additional unauthorized operations are possible
General mitigation guidance
Mitigation generally focuses on ensuring that all database operations use parameterized queries or equivalent safe query-building mechanisms.
Common defensive patterns include:
- Enforcing strict scalar types and allowlisted formats for notification identifiers
- Rejecting unexpected arrays and other malformed parameter structures before business logic
- Applying server-side authorization checks independently of client-supplied identifiers
- Limiting database account privileges to the minimum required operations
- Avoiding storage or display of sensitive query results in notification attributes
- Reducing trust in request parameters through centralized validation and normalization
Mitigation generally focuses on ensuring that all database operations use parameterized queries or equivalent safe query-building mechanisms.
Common defensive patterns include:
- Enforcing strict scalar types and allowlisted formats for notification identifiers
- Rejecting unexpected arrays and other malformed parameter structures before business logic
- Applying server-side authorization checks independently of client-supplied identifiers
- Limiting database account privileges to the minimum required operations
- Avoiding storage or display of sensitive query results in notification attributes
- Reducing trust in request parameters through centralized validation and normalization
How teams detect issues like this
Detection can include static analysis for string concatenation or interpolation of request parameters into SQL statements, along with review of query-builder calls that accept unvalidated arrays or loosely typed identifiers.
Code review should examine notification handlers, parameter normalization, authorization boundaries, and persistence of database results. Runtime monitoring may flag unusual notification requests, malformed parameter shapes, unexpected cross-table queries, or access to account-related columns. Automated security scanning and policy checks can help enforce parameterized database access and strict input schemas.
Detection can include static analysis for string concatenation or interpolation of request parameters into SQL statements, along with review of query-builder calls that accept unvalidated arrays or loosely typed identifiers.
Code review should examine notification handlers, parameter normalization, authorization boundaries, and persistence of database results. Runtime monitoring may flag unusual notification requests, malformed parameter shapes, unexpected cross-table queries, or access to account-related columns. Automated security scanning and policy checks can help enforce parameterized database access and strict input schemas.
