LibreNMS Missing Authorization Leading to Port Deletion

Executive Summary

LibreNMS before version 26.9.0 has a missing authorization vulnerability in the PortsController::purge function. This allows users with only global-read privileges to delete ports without proper delete permissions. Attackers can send a DELETE request to /ports/purge with purge=all to permanently erase all deleted ports across all visible devices.

Useful 0 Not Useful 0

Detection Guidance

Check LibreNMS logs for DELETE requests to /ports/purge with purge=all parameter. Monitor for unauthorized port deletions or unusual activity from global-read accounts. Verify user privileges in LibreNMS settings to ensure no read-only users have delete permissions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with read-only access to irreversibly delete ports, disrupting network monitoring and capacity tracking. It can lead to data loss, auditing issues, and potential network outages by removing critical device port information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized data deletion, which may violate record-keeping and audit requirements in GDPR and HIPAA. Permanent loss of port data could hinder investigations and reporting obligations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade LibreNMS to version 26.9.0 or later immediately. Review and restrict user privileges, ensuring global-read accounts cannot perform delete operations. Monitor for any signs of exploitation and audit port deletion logs.

Useful 0 Not Useful 0