CVE-2020-36947: LibreNMS SQL Injection Vulnerability

CVE-2020-36947 Overview

CVE-2020-36947 is an authenticated SQL injection vulnerability affecting LibreNMS version 1.46. The vulnerability exists in the MAC accounting graph endpoint, allowing remote attackers with valid credentials to extract sensitive database information. By manipulating the sort parameter with crafted SQL injection payloads, attackers can perform time-based blind SQL injection attacks to retrieve database contents, potentially exposing credentials, configuration data, and other sensitive information stored within the LibreNMS database.

Critical Impact

Authenticated attackers can exploit SQL injection in the MAC accounting graph endpoint to extract sensitive database information, potentially compromising the entire network monitoring infrastructure and exposing credentials for monitored devices.

Affected Products

• LibreNMS 1.46

Discovery Timeline

• 2026-01-27 - CVE CVE-2020-36947 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2020-36947

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) exists in the MAC accounting graph functionality of LibreNMS 1.46. The application fails to properly sanitize user-supplied input in the sort parameter before incorporating it into SQL queries. This allows authenticated users to inject arbitrary SQL commands that are executed against the backend database.

The time-based blind SQL injection technique is particularly effective here, as attackers can infer database contents by observing response time differences when injected conditional statements cause deliberate delays. While authentication is required to exploit this vulnerability, any user with access to the MAC accounting graph endpoint can potentially leverage it to access data beyond their authorization level.

Root Cause

The root cause of this vulnerability is improper input validation and lack of parameterized queries in the MAC accounting graph endpoint. The sort parameter is directly concatenated into SQL queries without proper sanitization or escaping, enabling SQL injection attacks. This represents a failure to implement secure coding practices for database interactions.

Attack Vector

The attack is network-based and requires authentication to the LibreNMS web interface. Once authenticated, an attacker can craft malicious HTTP requests to the MAC accounting graph endpoint with a modified sort parameter containing SQL injection payloads. Using time-based blind SQL injection techniques, the attacker can systematically extract database contents including usernames, password hashes, API tokens, and device credentials stored by LibreNMS.

The vulnerability can be exploited by sending crafted requests to the vulnerable endpoint with SQL injection payloads that cause conditional database delays, allowing attackers to infer data one character at a time based on response timing.

Detection Methods for CVE-2020-36947

Indicators of Compromise

• Unusual or malformed HTTP requests to the MAC accounting graph endpoint containing SQL syntax characters such as single quotes, UNION, SELECT, SLEEP, or BENCHMARK
• Abnormally long response times from the LibreNMS application that may indicate time-based SQL injection attempts
• Database error messages in application logs indicating SQL syntax errors
• Multiple sequential requests to the same endpoint with slight parameter variations characteristic of blind SQL injection enumeration

Detection Strategies

• Implement web application firewall (WAF) rules to detect SQL injection patterns in the sort parameter and other user inputs
• Monitor LibreNMS access logs for suspicious request patterns targeting the MAC accounting graph endpoint
• Enable database query logging to identify anomalous or malicious SQL statements
• Deploy intrusion detection systems (IDS) with signatures for SQL injection attack patterns

Monitoring Recommendations

• Configure alerting for HTTP requests containing SQL injection keywords targeting LibreNMS endpoints
• Monitor database server performance for unusual query execution times that may indicate time-based SQL injection
• Review authentication logs for compromised accounts being used to launch SQL injection attacks
• Implement baseline monitoring for LibreNMS application behavior to detect anomalies

How to Mitigate CVE-2020-36947

Immediate Actions Required

• Upgrade LibreNMS to a patched version that addresses this SQL injection vulnerability
• Restrict network access to the LibreNMS web interface to trusted IP addresses only
• Review and audit user accounts with access to LibreNMS, removing unnecessary privileges
• Enable detailed logging and monitoring for the LibreNMS application to detect exploitation attempts

Patch Information

Organizations should update to a patched version of LibreNMS that addresses this SQL injection vulnerability. Consult the GitHub LibreNMS Repository and LibreNMS Official Site for the latest security updates and release information. Additional technical details about this vulnerability are available in the VulnCheck Advisory on LibreNMS SQL Injection and Exploit-DB #49246.

Workarounds

• Implement a web application firewall (WAF) in front of LibreNMS to filter SQL injection attempts
• Restrict access to the MAC accounting graph endpoint through network segmentation or access control lists
• Use a reverse proxy to sanitize incoming requests before they reach the LibreNMS application
• Consider temporarily disabling the MAC accounting feature if not critical to operations until a patch can be applied

# Example: Restrict access to LibreNMS using iptables
# Allow only trusted management network to access LibreNMS web interface
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP