Summary
A Reflected Cross-Site Scripting (XSS) vulnerability in the “metric” parameter of the “/wireless” and “/health” endpoints in the @LibreNMS/LibreNMS project allows an attacker to inject arbitrary JavaScript that executes immediately when a user loads the page.
Product
This vulnerability affects LibreNMS versions prior to 24.10.0 in the files:
librenms/includes/html/pages/wireless.inc.phplibrenms/includes/html/pages/health.inc.php
Impact
This vulnerability can lead to the execution of malicious code in the context of other users’ sessions, potentially compromising their accounts and allowing unauthorized actions.
Steps to reproduce
-
Construct a URL replacing
<your_host>and<device_id>as appropriate, for example:`http://<your_host>/wireless/metric=<script>constructor['constructor'](atob('Y29uZmlybShkb2N1bWVudC5kb21haW4p'))();<!---->` -
Paste that URL into a browser and press Enter.
-
Observe that a confirmation dialog appears, showing the current document domain.
Expected result:
A confirm dialog appears displaying the document’s domain, demonstrating that the injected code ran.
Remediation
Fixed in LibreNMS 24.10.0 by sanitizing and HTML-encoding the metric parameter in both wireless.inc.php and health.inc.php before output.
Credit
This issue was discovered and reported by Checkmarx Security Researcher Raphael Silva.
