Summary
A Reflected Cross-Site Scripting (XSS) vulnerability in the “logs” tab of a device in the @LibreNMS/LibreNMS project allows attackers to inject arbitrary JavaScript via the section parameter. The vulnerability stems from lack of sanitization in the report_this() function, causing the payload to be executed when the logs page is accessed.
Product
This vulnerability affects LibreNMS versions prior to 24.10.0 in librenms/includes/functions.php.
Impact
This vulnerability can lead to the execution of malicious code in the context of other users’ sessions, potentially compromising their accounts and allowing unauthorized actions.
Steps to reproduce
-
Construct the following URL (adjust host and device ID accordingly):
http://<your_host>/device/device=1/tab=logs/section=<script>constructor['constructor'](atob('Y29uZmlybShkb2N1bWVudC5kb21haW4p'))();</script> -
Access the URL in a browser.
-
Observe the JavaScript executes immediately, displaying a confirmation dialog with the document domain.
Expected result:
A confirmation dialog appears showing the current document domain, demonstrating execution of the injected script.
Remediation
Fixed in LibreNMS 24.10.0 by sanitizing the section parameter in report_this(), ensuring user input is encoded before rendering.
Credit
This issue was discovered and reported by Checkmarx Security Researcher Raphael Silva.
