Authorization Bypass in LibreNMS via Smokeping Graphs

Executive Summary

LibreNMS through version 26.9.1.1 has an authorization bypass vulnerability in the Smokeping graph functionality. The issue occurs in includes/html/graphs/smokeping/auth.inc.php where the system checks authorization based on the source probe device instead of the target device being rendered. This allows restricted users with access to a probe device to request graphs for any device by manipulating device IDs, enabling them to view latency data and enumerate device names without proper authorization.

Useful 0 Not Useful 0

Detection Guidance

Check LibreNMS logs for unauthorized access attempts to smokeping graphs. Inspect auth.inc.php for incorrect authorization checks on probe devices instead of target devices. Review graph generation requests for manipulated device IDs.

Useful 0 Not Useful 0

Impact Analysis

An attacker with low privileges who has access to a probe device can bypass authorization checks and view smokeping graphs for any target device. This exposes sensitive latency data, packet loss metrics, and other telemetry information for restricted devices. Additionally, device names can be enumerated through graph titles, potentially revealing network infrastructure details.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive network monitoring data, potentially violating data protection requirements under GDPR and HIPAA. Exposure of device names and performance metrics may constitute a breach of confidentiality obligations, especially if the data relates to protected health information or personally identifiable network infrastructure details.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade LibreNMS to the latest version beyond 26.9.1.1. Temporarily restrict access to smokeping graph functionality for low-privilege users. Monitor network traffic for suspicious graph requests.

Useful 0 Not Useful 0