CVE-2024-32479: 
PHP vulnerability analysis and mitigation

CVE-2024-32479 affects LibreNMS, an open-source PHP/MySQL/SNMP-based network monitoring system. The vulnerability, discovered in versions prior to 24.4.0, involves improper sanitization of the Service template name, which can lead to stored Cross-site Scripting (XSS). The issue was fixed in version 24.4.0 (GitHub Advisory).

The vulnerability exists in the ServiceTemplateController.php file where there is improper sanitization of the Service template name that reflects in the delete button onclick event. The unsanitized value can be modified and crafted as arbitrary JavaScript code. The vulnerability has received a CVSS v3.1 base score of 7.1 HIGH (Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) from GitHub, while NIST assigned a score of 5.4 MEDIUM (NVD, GitHub Advisory).

The Cross-site Scripting vulnerability can lead to cookie theft and enables attackers to execute arbitrary features within the application context. The high severity ratings for confidentiality, integrity, and availability indicate potential significant impact on system security (GitHub Advisory).

A proof of concept exists where an attacker can inject malicious JavaScript code through the template name field. The attack requires network access, high attack complexity, low privileges, and user interaction. The vulnerability can be triggered by entering crafted input in the service template name field under /services/templates (GitHub Advisory).

The vulnerability has been patched in LibreNMS version 24.4.0. Users should upgrade to this version or later to mitigate the risk. The fix involves proper handling of user input in the Service Templates functionality (GitHub Patch).