Summary
A Stored Cross-Site Scripting (XSS) vulnerability in the “Alert Transports” feature of the @LibreNMS/LibreNMS project allows authenticated users to inject arbitrary JavaScript through the “Details” section of an alert transport. The injected script executes in other users’ sessions when transport details are viewed, potentially compromising accounts and enabling unauthorized actions.
Product
This vulnerability affects LibreNMS versions prior to 24.9.0 in librenms/includes/html/print-alert-transports.php.
Impact
This vulnerability can lead to the execution of malicious code in the context of other users’ sessions, potentially compromising their accounts and allowing unauthorized actions.
Steps to reproduce
-
Log into the LibreNMS web interface.
-
Create a new alert transport and enter the following payload into any field that appears in the Details section:
test1<script>{onerror=alert}throw 1337</script> -
Save the transport and in LibreNMS, view or process the alert transport details.
-
Observe that the injected script executes, displaying an alert popup.
Expected result:
An alert popup appears with the message 1337, demonstrating that the injected JavaScript executed successfully.
Remediation
Fixed in LibreNMS 24.9.0 by properly escaping $instance->displayDetails() in print-alert-transports.php, preventing untrusted input from being inserted as HTML.
Credit
This issue was discovered and reported by Checkmarx Security Researcher Raphael Silva.
